oss-security - JBIG2 integer overflow fixed in Xpdf 4.04, Poppler 22.09.0

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <aca73c02-b870-1824-8cd2-515bbaaeebfc@protonmail.com>
Date: Fri, 02 Sep 2022 16:13:36 +0000
From: Art Manion <zmanion@...tonmail.com>
To: oss-security@...ts.openwall.com
Subject: JBIG2 integer overflow fixed in Xpdf 4.04, Poppler 22.09.0

Xpdf 4.04 (released 2022-04-18, CVE-2022-38171):

   <https://www.cve.org/CVERecord?id=CVE-2022-38171>

   <https://gist.github.com/zmanion/b2ed0d1a0cec163ecd07d5e3d9740dc6>

Poppler 22.09.0 (released 2022-09-01, CVE-2022-38784):

   <https://www.cve.org/CVERecord?id=CVE-2022-38784>

   <https://gitlab.freedesktop.org/poppler/poppler/-/blob/master/NEWS>

   <https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1261/diffs?commit_id=27354e9d9696ee2bc063910a6c9a6b27c5184a52>

The lineage of this bug includes a variant used as part of the FORCEDENTRY exploit chain (targeting Apple devices).  The bug readily crashes affected software, code execution is not straightforward and would depend heavily on the context in which affected software is used.

FORCEDENTRY was first discussed publicly in 2021, it took some time to track down the affected OSS components.  Lots of packages are downstream of Xpdf and Poppler.

Crashing test case, use at your own risk:

   <https://github.com/jeffssh/CVE-2021-30860>

For background, Apple CoreGraphics fixes released in September 2021 (CVE-2021-30860):

   <https://www.cve.org/CVERecord?id=CVE-2021-30860>

   <https://support.apple.com/en-ca/HT212807>

   <https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html>

Regards,

  - Art

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.