Bug 2234527 (CVE-2022-37050) - CVE-2022-37050 poppler: abort in PDFDoc::savePageAs in PDFDoc.c
Summary: CVE-2022-37050 poppler: abort in PDFDoc::savePageAs in PDFDoc.c
Keywords:
Status: NEW
Alias: CVE-2022-37050
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2234531 2234532 2234533 2234534 2234535 2234537 2234538 2234539 2234541 2234542 2234544 2234545 2234546 2234547 2234548
Blocks: 2234525
TreeView+ depends on / blocked
 
Reported: 2023-08-24 18:39 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-10-23 18:27 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:8405 0 None None None 2024-10-23 18:27:35 UTC

Description Guilherme de Almeida Suckevicz 2023-08-24 18:39:18 UTC 
In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662.

Reference:
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1274
https://gitlab.freedesktop.org/poppler/poppler/-/commit/dcd5bd8238ea448addd102ff045badd0aca1b990
Comment 1 Guilherme de Almeida Suckevicz 2023-08-24 18:55:55 UTC 
Created mingw-poppler tracking bugs for this issue:

Affects: fedora-all [bug 2234531]


Created poppler tracking bugs for this issue:

Affects: fedora-all [bug 2234532]
Note You need to log in before you can comment on or make changes to this bug.