PatchTheCVExpdf project vulnerabilities
Recent CVEs affecting xpdf project products. 11 tracked.
xpdf project has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-08-16. Highest priority: CVE-2022-38238 (score 39/100).
- CVE-2022-38238 HIGH 7.8 DOWNGRADE XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream
- CVE-2022-38237 HIGH 7.8 DOWNGRADE XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream
- CVE-2022-38236 HIGH 7.8 DOWNGRADE XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lex
- CVE-2022-38235 MEDIUM 5.5 DOWNGRADE XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Strea
- CVE-2022-38234 MEDIUM 5.5 DOWNGRADE XPDF commit ffaf11c was discovered to contain a segmentation violation via Lexer::getObj(Object*) at /xpdf/Lex
- CVE-2022-38233 MEDIUM 5.5 DOWNGRADE XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::readMCURow() at /xpdf/St
- CVE-2022-38231 HIGH 7.8 DOWNGRADE XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::getChar() at /xpdf/Stream.
- CVE-2022-38230 MEDIUM 5.5 DOWNGRADE XPDF commit ffaf11c was discovered to contain a floating point exception (FPE) via DCTStream::decodeImage() at
- CVE-2022-38229 HIGH 7.8 DOWNGRADE XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*)
- CVE-2022-38228 HIGH 7.8 DOWNGRADE XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf
- CVE-2022-38227 HIGH 7.8 DOWNGRADE XPDF commit ffaf11c was discovered to contain a stack overflow via __asan_memcpy at asan_interceptors_memintri
FAQ
How do I fix xpdf project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xpdf project being exploited right now?
None of the tracked xpdf project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xpdf project CVE should I patch first?
CVE-2022-38238 currently ranks highest (39/100): XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.