CVE catalog

CVE-2022-38784

poppler: CVE-2022-38784

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.63% · Oct 25, 2026

Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2022-38171 in Xpdf.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpopplersid26.07.0-3fixed
Debianpopplerforky26.07.0-3fixed
Debianpopplertrixie25.03.0-5+deb13u4fixed
Debianpopplertrixie-security25.03.0-5+deb13u3fixed
Debianpopplerbookworm22.12.0-2+deb12u2fixed
Debianpopplerbookworm-security22.12.0-2+deb12u3fixed
Ubuntupopplerpro0.33.0-0ubuntu3vulnerable
Ubuntupopplerpro0.37.0-0ubuntu1vulnerable
Ubuntupopplerpro0.38.0-0ubuntu1vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.1vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.2vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.3vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.4vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.5vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.6vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.7vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.8vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.9vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.10vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.11vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.12vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.13vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.14vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.15vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.16vulnerable
Ubuntupopplerpro0.41.0-0ubuntu1.16+esm1fixed
Ubuntupoppler18.040.57.0-2ubuntu4vulnerable
Ubuntupoppler18.040.57.0-2ubuntu5vulnerable
Ubuntupoppler18.040.62.0-1ubuntu1vulnerable
Ubuntupoppler18.040.62.0-2ubuntu1vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.1vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.2vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.4vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.5vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.6vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.7vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.8vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.9vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.10vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.11vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.12vulnerable
Ubuntupoppler18.040.62.0-2ubuntu2.13fixed
Ubuntupoppler20.040.80.0-0ubuntu1vulnerable
Ubuntupoppler20.040.80.0-0ubuntu3vulnerable
Ubuntupoppler20.040.80.0-0ubuntu4vulnerable
Ubuntupoppler20.040.80.0-0ubuntu5vulnerable
Ubuntupoppler20.040.85.0-1ubuntu1vulnerable
Ubuntupoppler20.040.85.0-1ubuntu3vulnerable
Ubuntupoppler20.040.86.1-0ubuntu1vulnerable
Ubuntupoppler20.040.86.1-0ubuntu1.1fixed
Ubuntupoppler22.0421.06.1-1vulnerable
Ubuntupoppler22.0421.11.0-1~ubuntu2vulnerable
Ubuntupoppler22.0422.02.0-2vulnerable
Ubuntupoppler22.0422.02.0-2ubuntu0.1fixed
Susepopplerlinux enterprise module for basesystem 15 sp40.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise high performance computing 15 sp2-ltss0.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise high performance computing 15 sp3-espos0.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise high performance computing 15 sp3-ltss0.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise real time 15 sp30.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise server 15 sp2-ltss0.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise server 15 sp3-ltss0.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise server for sap applications 15 sp20.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise server for sap applications 15 sp30.79.0-150200.3.8.1fixed
Susepopplermanager proxy 4.20.79.0-150200.3.8.1fixed
Susepopplermanager server 4.20.79.0-150200.3.8.1fixed
Susepopplerenterprise storage 70.79.0-150200.3.8.1fixed
Susepopplerenterprise storage 7.10.79.0-150200.3.8.1fixed
Opensusepopplerleap 15.40.79.0-150200.3.8.1fixed
Susepopplerlinux enterprise module for basesystem 15 sp422.01.0-150400.3.3.1fixed
Susepopplerlinux enterprise module for package hub 15 sp422.01.0-150400.3.3.1fixed
Susepoppler-qt5linux enterprise module for package hub 15 sp422.01.0-150400.3.3.1fixed
Opensusepopplerleap 15.422.01.0-150400.3.3.1fixed
Opensusepoppler-qt5leap 15.422.01.0-150400.3.3.1fixed
Opensusepoppler-qt6leap 15.422.01.0-150400.3.3.1fixed
Opensusepopplertumbleweed22.09.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpopplersourcesid22.08.0-2.1not yet assignedNot reported[1018971]
Debianpopplersourceforky22.08.0-2.1not yet assignedNot reported[1018971]
Debianpopplersourcetrixie22.08.0-2.1not yet assignedNot reported[1018971]
Debianpopplersourcebookworm22.08.0-2.1not yet assignedNot reported[1018971]
Ubuntupopplerdebpro0.41.0-0ubuntu1.16+esm1Not reportedUSN-5606-1Not reported
Ubuntupopplerdeb18.040.62.0-2ubuntu2.13Not reportedUSN-5606-1Not reported
Ubuntupopplerdeb20.040.86.1-0ubuntu1.1Not reportedUSN-5606-1Not reported
Ubuntupopplerdeb22.0422.02.0-2ubuntu0.1Not reportedUSN-5606-1Not reported
Susepopplerrpmlinux enterprise module for basesystem 15 sp40.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise high performance computing 15 sp2-ltss0.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise high performance computing 15 sp3-espos0.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise high performance computing 15 sp3-ltss0.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise real time 15 sp30.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise server 15 sp2-ltss0.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise server 15 sp3-ltss0.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise server for sap applications 15 sp20.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise server for sap applications 15 sp30.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmmanager proxy 4.20.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmmanager server 4.20.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmenterprise storage 70.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmenterprise storage 7.10.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Opensusepopplerrpmleap 15.40.79.0-150200.3.8.1Not reportedSUSE-SU-2023:0677-1Not reported
Susepopplerrpmlinux enterprise module for basesystem 15 sp422.01.0-150400.3.3.1Not reportedSUSE-SU-2023:0495-1Not reported
Susepopplerrpmlinux enterprise module for package hub 15 sp422.01.0-150400.3.3.1Not reportedSUSE-SU-2023:0495-1Not reported
Susepoppler-qt5rpmlinux enterprise module for package hub 15 sp422.01.0-150400.3.3.1Not reportedSUSE-SU-2023:0495-1Not reported
Opensusepopplerrpmleap 15.422.01.0-150400.3.3.1Not reportedSUSE-SU-2023:0495-1Not reported
Opensusepoppler-qt5rpmleap 15.422.01.0-150400.3.3.1Not reportedSUSE-SU-2023:0495-1Not reported
Opensusepoppler-qt6rpmleap 15.422.01.0-150400.3.3.1Not reportedSUSE-SU-2023:0495-1Not reported
Opensusepopplerrpmtumbleweed22.09.0-1.1Not reportedOPENSUSE-SU-2024:12362-1Not reported

[Debian bug #1018971]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • [libpoppler126]Unknown

    Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · all · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · all · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · all · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · all · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

  • [poppler-utils]Unknown

    Source package: [poppler]

    Details (4)
    • 22.12.0-2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

    • 22.12.0-2+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 22.08.0-2.1

      dsa · poppler · debian · bookworm

[openSUSE Tumbleweed]

  • [libpoppler162]Unknown

    Source package: [poppler]

    Details (1)
    • 26.07.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 22.09.0-1.1

      Version impact unknown

      dsa · poppler · opensuse · tumbleweed

  • Source package: [poppler]

    Details (1)
    • 26.07.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 22.09.0-1.1

      Version impact unknown

      dsa · poppler · opensuse · tumbleweed

  • Source package: [poppler]

    Details (1)
    • 26.07.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 22.09.0-1.1

      Version impact unknown

      dsa · poppler · opensuse · tumbleweed

  • Source package: [poppler]

    Details (1)
    • 26.07.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 22.09.0-1.1

      Version impact unknown

      dsa · poppler · opensuse · tumbleweed

  • Source package: [poppler]

    Details (1)
    • 26.07.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 22.09.0-1.1

      Version impact unknown

      dsa · poppler · opensuse · tumbleweed

  • Source package: [poppler]

    Details (1)
    • 26.07.0-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 22.09.0-1.1

      Version impact unknown

      dsa · poppler · opensuse · tumbleweed

Next results

Observed:

References