MGASA-2022-0320

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2022-0320.html
Import Source
https://advisories.mageia.org/MGASA-2022-0320.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2022-0320
Related
Published
2022-09-07T05:27:53Z
Modified
2022-09-07T04:18:04Z
Summary
Updated xpdf packages fix security vulnerability
Details

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc. (CVE-2022-24106)

Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc. (CVE-2022-24107)

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. (CVE-2022-38171)

References
Credits

Affected packages

Mageia:8 / xpdf

Package

Name
xpdf
Purl
pkg:rpm/mageia/xpdf?arch=source&distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.04-1.mga8

Ecosystem specific 

{
    "section": "core"
}