CVE-2022-38784

poppler: integer overflow in JBIG2 decoder using malformed files

Loading…

Severity

Moderate

Red Hat Product Security

7.8

CVSS 3.1

Review impact separately from score.

Published · August 30, 2022

Updated · June 26, 2026

Description

An integer overflow issue was discovered in Popplers' JBIG2 decoder in the JBIG2Stream::readTextRegionSeg() function in JBIGStream.cc file. This flaw allows an attacker to trick a user into opening a malformed PDF file or JBIG2 image in the application, triggering an integer overflow, which could result in a crash or may lead to the execution of arbitrary code on the target system.

Statement

This vulnerability is referred as CVE-2021-30860 in Apple CoreGraphics and CVE-2022-38171 in Xpdf.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-190 · Integer Overflow or Wraparound