Bug 13299

Summary:	[CVE 21] poppler 22.05.0 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED NOTABUG	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	a.proklov, i.gaptrakhmanov, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2022-38171,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-05-03 18:01:58 MSK

Please patch CVEs for package poppler version 22.05.0
  
INFO (CVEs are): poppler 22.05.0
 cves found
CVE-2022-38171
Desc: Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).
Link: https://nvd.nist.gov/vuln/detail/CVE-2022-38171
Severity: HIGH

Comment 1 ilfat 2023-05-24 20:55:57 MSK

********** QA ADVISORY **********

CVE-2022-38171 не относится к данному проекту.
Исправление подобной уязвимости (CVE-2021-30860) было произведено ранее.
В спек добавлена запись "CVE-2022-38171" для игнорирования данной уязвимости сканером.

https://abf.io/build_lists/4443825 x86_64
https://abf.io/build_lists/4443826 aarch64
https://abf.io/build_lists/4443827 i686

Comment 2 Dmitry Postnikov 2023-05-26 14:07:04 MSK

***************************
The update sent to testings

Comment 3 Vladimir Potapov 2023-05-30 17:56:08 MSK

poppler-22.05.0-6
https://abf.io/build_lists/4443825 x86_64
https://abf.io/build_lists/4443826 aarch64
https://abf.io/build_lists/4443827 i686
*********************** Advisory **********************
Rebuild
*******************************************************
QA Verified

Comment 4 Yury 2023-07-25 16:38:32 MSK

Secteam Verified