Vulnerability Description
In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.
CVSS Score
7.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Glyphandcog | Xpdfreader | < 4.04 |
Related Weaknesses (CWE)
References
- http://www.xpdfreader.com/security-fixes.htmlVendor Advisory
- https://dl.xpdfreader.com/xpdf-4.04.tar.gzProductVendor Advisory
- http://www.xpdfreader.com/security-fixes.htmlVendor Advisory
- https://dl.xpdfreader.com/xpdf-4.04.tar.gzProductVendor Advisory
FAQ
What is CVE-2022-24106?
CVE-2022-24106 is a vulnerability with a CVSS score of 7.8 (HIGH). In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in St...
How severe is CVE-2022-24106?
CVE-2022-24106 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24106?
Check the references section above for vendor advisories and patch information. Affected products include: Glyphandcog Xpdfreader.