Skip to content
OpenAdvisories
Medium ALAS2-2023-2075 2 CVEs

Moderate: poppler security update (Amazon Linux 2)

Published Jun 5, 2023 · Updated Jun 7, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38784: Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf. CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 poppler 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-cpp 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-cpp-devel 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-debuginfo 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-demos 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-devel 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-glib 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-glib-devel 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-qt 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-qt-devel 0:0.26.5-43.amzn2.1.1
Amazon Linux · 2 poppler-utils 0:0.26.5-43.amzn2.1.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-27337.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-38784.html