CVE-2022-30775: Medium severity xpdf vulnerability

Published May 16, 2022

Updated

xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKECXXCOMPILER=afl-clang-fast++ option.

Affected Software

1 affected component

Xpdfreader Xpdf=4.04

Event History

May 16, 2022

CVE Published

via MITRE·02:54 AM

Data Sourced

via MITRE·02:54 AM

Description

Frequently Asked Questions

What is CVE-2022-30775?

CVE-2022-30775 is a vulnerability in xpdf 4.04 that allows an attacker to trigger excessive memory allocation by sending a crafted PDF document to the pdftoppm binary.

How can CVE-2022-30775 be triggered?

CVE-2022-30775 can be triggered by sending a crafted PDF document to the pdftoppm binary using the DCMAKE_CXX_COMPILER=afl-clang-fast++ option.

What is the severity of CVE-2022-30775?

CVE-2022-30775 has a severity rating of 5.5, which is considered medium.

Which software versions of xpdf are affected by CVE-2022-30775?

xpdf version 4.04 is affected by CVE-2022-30775.

How can I fix CVE-2022-30775?

A fix for CVE-2022-30775 may be available from the xpdfreader website or by updating to a version of xpdf that is not affected.