CVE-2022-30775: Medium severity Xpdfreader Xpdf vulnerability
xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKECXXCOMPILER=afl-clang-fast++ option.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/xpdfto a version that resolves this vulnerability.Fixed in 4.05-r0
Event History
Frequently Asked Questions
What is CVE-2022-30775?
CVE-2022-30775 is a vulnerability in xpdf 4.04 that allows an attacker to trigger excessive memory allocation by sending a crafted PDF document to the pdftoppm binary.
How can CVE-2022-30775 be triggered?
CVE-2022-30775 can be triggered by sending a crafted PDF document to the pdftoppm binary using the DCMAKE_CXX_COMPILER=afl-clang-fast++ option.
What is the severity of CVE-2022-30775?
CVE-2022-30775 has a severity rating of 5.5, which is considered medium.
Which software versions of xpdf are affected by CVE-2022-30775?
xpdf version 4.04 is affected by CVE-2022-30775.
How can I fix CVE-2022-30775?
A fix for CVE-2022-30775 may be available from the xpdfreader website or by updating to a version of xpdf that is not affected.