Bug 30804 - xpdf new security issues CVE-2022-2410[67] and CVE-2022-38171
Summary: xpdf new security issues CVE-2022-2410[67] and CVE-2022-38171
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 30812 32824
  Show dependency treegraph
 
Reported: 2022-09-02 18:24 CEST by David Walser
Modified: 2024-02-09 10:23 CET (History)
5 users (show)

See Also:
Source RPM: xpdf-4.03-1.mga8.src.rpm
CVE: CVE-2022-24106, CVE-2022-24107, CVE-2022-38171
Status comment:


Attachments

Description David Walser 2022-09-02 18:24:07 CEST
Xpdf 4.04, released on April 18, fixes three security issues:
http://www.xpdfreader.com/security-fixes.html

It also lists two "will be fixed" issues that may not have fixes available yet, so we'll need to file another bug for those:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30524
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33108
Comment 1 Nicolas Salguero 2022-09-04 21:45:59 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc. (CVE-2022-24106)

Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc. (CVE-2022-24107)

Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. (CVE-2022-38171)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24106
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24107
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38171
http://www.xpdfreader.com/security-fixes.html
========================

Updated packages in core/updates_testing:
========================
xpdf-4.04-1.mga8
xpdf-common-4.04-1.mga8

from SRPM:
xpdf-4.04-1.mga8.src.rpm

CVE: (none) => CVE-2022-24106, CVE-2022-24107, CVE-2022-38171
Status: NEW => ASSIGNED
Assignee: nicolas.salguero => qa-bugs
CC: (none) => nicolas.salguero

David Walser 2022-09-05 00:03:44 CEST

Blocks: (none) => 30812

Comment 2 Morgan Leijström 2022-09-05 00:55:09 CEST
Installed cleanly.
Opened a couple pdf files.
Used different view modes.
Saved a page as jpeg.
Printed a document to Boomaga.
Tried internet link, browser opens

No localisation (not Swedish anyway)

Not optimally adapted to Plasma which I use:
§ Clicking internet link in pdf, chromium opens (running Plasma, my default browser is Firefox, but maybe some other DE i installed have chromium as preference)
§ After having saved, I need to tell Dolphin to update to see the file.

But this is OK, I think.

Nothing to worry about in output in terminal from where i started it.

Plasma, 4K screen, nvidia-current and kernel from backport.

CC: (none) => fri
Whiteboard: (none) => MGA8-64-OK

Comment 3 Thomas Andrews 2022-09-05 02:35:02 CEST
Validating. Advisory in Comment 1.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 4 David Walser 2022-09-06 14:30:14 CEST
Some more background on this, including PoC information for CVE-2022-38171:
https://www.openwall.com/lists/oss-security/2022/09/02/11
Dave Hodgins 2022-09-07 05:19:16 CEST

Keywords: (none) => advisory
CC: (none) => davidwhodgins

Comment 5 Mageia Robot 2022-09-07 07:29:11 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0320.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Nicolas Salguero 2024-02-09 10:23:00 CET

Blocks: (none) => 32824


Note You need to log in before you can comment on or make changes to this bug.