Heap-Buffer Overflow in XPDF Product from Vendor XPDF
CVE-2022-38229

7.8HIGH

Key Information:

Vendor

XPDF Project

Status
XPDF
Vendor
CVE Published:
16 August 2022

What is CVE-2022-38229?

A heap-buffer overflow has been identified in the XPDF product due to an oversight in the DCTStream::readHuffSym function. This vulnerability arises from improper handling of the DCTHuffTable structure during the reading process, which can lead to potential arbitrary code execution and compromise the security of the affected system. Users are advised to review their installations and apply necessary updates to mitigate the risks associated with this vulnerability.

References

https://github.com/jhcloos/xpdf/issues/3
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.