Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-38784: Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | poppler | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-cpp | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-cpp-debuginfo | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-cpp-devel | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-debuginfo | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-debugsource | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-devel | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib-debuginfo | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib-devel | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-glib-doc | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-utils | 0:22.08.0-3.amzn2023.0.1 |
| Amazon Linux · 2023 | poppler-utils-debuginfo | 0:22.08.0-3.amzn2023.0.1 |
Vulnerabilities 1
-
Unscored —
Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSe…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-38784.html