Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-38349: An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | poppler | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-cpp | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-cpp-debuginfo | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-cpp-devel | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-debuginfo | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-debugsource | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-devel | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-glib | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-glib-debuginfo | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-glib-devel | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-glib-doc | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-utils | 0:22.08.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | poppler-utils-debuginfo | 0:22.08.0-3.amzn2023.0.3 |
Vulnerabilities 1
-
Unscored —
An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-38349.html