CVE-2022-38222
Gentoo Linux Security Advisory 202409-25
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
Se presenta un problema de uso de memoria previamente liberada en la función JBIG2Stream::close() ubicado en el archivo JBIG2Stream.cc en Xpdf 4.04. Puede desencadenarse mediante el envío de un archivo PDF diseñado a (por ejemplo) el binario pdfimages. Permite a un atacante causar una denegación de servicio o posiblemente tener otro impacto no especificado
Multiple vulnerabilities have been found in Xpdf, the worst of which could result in denial of service. Versions greater than or equal to 4.05 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-08-15 CVE Reserved
- 2022-08-15 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2025-06-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-416: Use After Free
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://forum.xpdfreader.com/viewtopic.php?f=3&t=42320 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xpdfreader Search vendor "Xpdfreader" | Xpdf Search vendor "Xpdfreader" for product "Xpdf" | 4.04 Search vendor "Xpdfreader" for product "Xpdf" and version "4.04" | - |
Affected
| ||||||