Bug 1214723 (CVE-2022-48545) - VUL-0: CVE-2022-48545: poppler: infinite recursion in Catalog:findDestInTree
Summary: VUL-0: CVE-2022-48545: poppler: infinite recursion in Catalog:findDestInTree
Status: RESOLVED FIXED
Alias: CVE-2022-48545
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/376064/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-48545:5.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-29 06:23 UTC by Alexander Bergmann
Modified: 2024-05-29 12:15 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-08-29 06:23:15 UTC
CVE-2022-48545

An infinite recursion in Catalog::findDestInTree can cause denial of service for
xpdf 4.02.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48545
https://www.cve.org/CVERecord?id=CVE-2022-48545
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42092
Comment 1 Alexander Bergmann 2023-08-29 06:46:16 UTC
https://forum.xpdfreader.com/viewtopic.php?p=43250&sid=b56148777024a4c01b618ade7be52e8d#p43250

"This is a known issue -- loops in the PDF object structure can cause problems for Xpdf. Xpdf 4 catches some of these cases, but not all of them. I'm working on a more robust loop detector for Xpdf 5."
Comment 2 Alexander Bergmann 2023-08-29 06:48:35 UTC
No upstream fix available. The reproducer does not trigger any direct issue.
Comment 6 Petr Gajdos 2023-10-06 12:48:03 UTC
BEFORE

15sp4,15sp2,15/poppler:

:/214723 # pdftohtml poc.txt /dev/null
Syntax Error: loop in NameTree (numObj: 4)   <<<<<
Syntax Error: failed to look up (wl0)
Syntax Warning: Bad named destination value
Page-1
:/214723 #

12sp2,12/poppler

:/214723 # pdftohtml poc.txt /dev/null
Segmentation fault (core dumped)
:/214723 #


PATCH

xpdf bug, patch not available (see comment 1)

Considering affected: 12sp2,12/poppler


AFTER

12sp2,12/poppler

:/214723 # pdftohtml poc.txt /dev/null
Syntax Error: loop in NameTree (numObj: 4)
Syntax Error: failed to look up (wl0)
Page-1
:/214723 #
Comment 7 Petr Gajdos 2023-10-10 10:35:13 UTC
Will submit for 12sp2,12/poppler.
Comment 8 Petr Gajdos 2023-10-17 12:10:08 UTC
Packages submitted.

I believe all fixed.
Comment 13 Maintenance Automation 2023-11-03 16:30:06 UTC
SUSE-SU-2023:4362-1: An update that solves nine vulnerabilities can now be installed.

Category: security (moderate)
Bug References: 1112424, 1112428, 1128114, 1129202, 1140745, 1143570, 1214256, 1214723, 1214726
CVE References: CVE-2018-18454, CVE-2018-18456, CVE-2019-13287, CVE-2019-14292, CVE-2019-9545, CVE-2019-9631, CVE-2020-36023, CVE-2022-37052, CVE-2022-48545
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1
SUSE Linux Enterprise Server 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): poppler-qt-0.43.0-16.40.1, poppler-0.43.0-16.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Maintenance Automation 2023-11-24 12:30:21 UTC
SUSE-SU-2023:4546-1: An update that solves six vulnerabilities can now be installed.

Category: security (moderate)
Bug References: 1128114, 1129202, 1143570, 1214256, 1214723, 1214726
CVE References: CVE-2019-14292, CVE-2019-9545, CVE-2019-9631, CVE-2020-36023, CVE-2022-37052, CVE-2022-48545
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): poppler-0.24.4-14.41.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Robert Frohl 2024-05-29 12:15:08 UTC
done, closing