Bug 1202698 – VUL-0: CVE-2022-33108: poppler: a stack overflow vulnerability via the Object:Copy class of object.cc

Bug 1202698 - (CVE-2022-33108) VUL-0: CVE-2022-33108: poppler: a stack overflow vulnerability via the Object:Copy class of object.cc

(CVE-2022-33108)
Summary:	VUL-0: CVE-2022-33108: poppler: a stack overflow vulnerability via the Object...

Status:	RESOLVED INVALID

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Major
Target Milestone:	---
Assigned To:	Peter Simons
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/335800/
Whiteboard:	CVSSv3.1:SUSE:CVE-2022-33108:7.8:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2022-08-24 12:01 UTC by Hu
Modified:	2022-08-29 10:40 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
poc (1.10 KB, application/pdf) 2022-08-29 10:40 UTC, Hu	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Hu 2022-08-24 12:01:47 UTC

rh#2103120

XPDF v4.04 was discovered to contain a stack overflow vulnerability via the Object::Copy class of object.cc files.

https://forum.xpdfreader.com/viewtopic.php?f=3&t=42284
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42286
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42287

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2103120
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33108
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33108
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42284
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42286
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42287

Comment 1 Hu 2022-08-24 12:02:11 UTC

The fix will be in xpdf 4.05, lets wait for that.

Comment 2 Hu 2022-08-29 10:38:48 UTC

Okay, nevermind I could not reproduce this with the latest poppler version (6b5437a07535d5fd07c114e71c2cbff9b2a2f454), so I would close this as not affected.

Comment 3 Hu 2022-08-29 10:40:20 UTC

Created attachment 861163 [details]
poc