{"id":"CVE-2022-24107","aliases":["ALPINE-CVE-2022-24107","EUVD-2022-29019","GHSA-xwhw-9p7r-3vq8","MGASA-2022-0320","UBUNTU-CVE-2022-24107"],"status":"published","title":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","description":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00312,"percentile":0.24403,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2022-08-30T03:04:49Z","modified":"2026-11-03T07:30:14Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"xpdf","fixed_in":["4.04-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xpdf","fixed_in":["4.04-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xpdf","fixed_in":["4.04-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xpdf","fixed_in":["4.04-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xpdf","fixed_in":["4.04-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xpdf","fixed_in":["4.04-r0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texlive-bin","fixed_in":["2019.20190605.51237-3ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"texlive-bin","fixed_in":["2021.20210626.59705-1ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-r0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.04-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"emscripten","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.4-2.1","7.1.8-1","7.1.10-1","7.1.10-1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xpdf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.03-17ubuntu2","3.03-17ubuntu3","3.03-17ubuntu5","3.03-18","3.04-1","3.04-1build1","3.04-1ubuntu1","3.04-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"emscripten","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.7-2","7.2.7-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2019.20190605.51237-3ubuntu0.2+esm1"}]}],"versions":["2019.20190605.51237-2build1","2019.20190605.51237-3","2019.20190605.51237-3build1","2019.20190605.51237-3build2","2019.20190605.51237-3ubuntu0.1","2019.20190605.51237-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.9-1","7.2.13-2","7.2.13-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"emscripten","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.13~dfsg-1","3.1.1~dfsg+~1.39.6-5ubuntu4","3.1.2~dfsg+~1.39.6-6ubuntu1","3.1.3~dfsg-4ubuntu1","3.1.3~dfsg-5ubuntu1","3.1.4~dfsg-7ubuntu1","3.1.5~dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.23+dfsg1-2","7.2.24+dfsg1-1","7.2.24+dfsg1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"texlive-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.20210626.59705-1ubuntu0.3"}]}],"versions":["2020.20200327.54578-7","2020.20200327.54578-7build1","2021.20210626.59705-1","2021.20210626.59705-1build1","2021.20210626.59705-1ubuntu0.1","2021.20210626.59705-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"emscripten","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.6~dfsg-5","3.1.6~dfsg-6","3.1.6~dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.27+dfsg1-2","7.2.28-2","7.2.28-2.1build2","7.2.28-2.1build3","7.2.28-2.1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"emscripten","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.69+dfsg-1","3.1.69+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.30-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"emscripten","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.69+dfsg-4","6.0.5+dfsg+~1.41.5-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.30-1build2","7.2.30-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"emscripten","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.69+dfsg-3","3.1.69+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ipe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.2.30-1build1","7.2.30-1build2"]}],"products":[{"vendor":"glyphandcog","product":"xpdfreader"}],"references":[{"url":"http://www.xpdfreader.com/security-fixes.html","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://dl.xpdfreader.com/xpdf-4.04.tar.gz","tags":["x_transferred","Product","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24107"},{"url":"https://dl.xpdfreader.com/old/xpdf-4.04.tar.gz","tags":["report"]},{"url":"http://www.xpdfreader.com/old-versions.html","tags":["report"]},{"url":"https://github.com/advisories/GHSA-xwhw-9p7r-3vq8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-24107","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0320.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24107","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7985-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-24107","description":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","status":"published","published":"2022-08-30T03:04:49.762Z","modified":"2024-09-17T02:42:28.252Z","updated_at":"2026-11-02T14:34:34.576287Z"}],"euvd":[{"id":"EUVD-2022-29019","description":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","status":"published","published":"2022-08-30T03:04:49Z","modified":"2024-09-17T02:42:28Z","updated_at":"2026-11-03T00:28:37.764675Z"}],"ghsa":[{"id":"GHSA-xwhw-9p7r-3vq8","title":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","description":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","status":"published","published":"2022-08-31T00:00:23Z","modified":"2023-01-30T05:06:59Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:47:36.345061Z"}],"nvd":[{"id":"CVE-2022-24107","description":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","status":"published","published":"2022-08-30T04:15:10.853Z","modified":"2026-06-17T04:31:18.23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:25.883929Z"}],"osv":[{"id":"ALPINE-CVE-2022-24107","description":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","status":"published","published":"2022-08-30T04:15:10.853Z","modified":"2026-11-03T07:30:14.444586102Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"UBUNTU-CVE-2022-24107","description":"Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.","status":"published","published":"2022-08-30T04:15:00Z","modified":"2026-10-17T12:56:21.057153744Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"MGASA-2022-0320","title":"Updated xpdf packages fix security vulnerability","description":"In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the\n'interleaved' flag to be changed after the first scan of the image,\nleading to an unknown integer-related vulnerability in Stream.cc.\n(CVE-2022-24106)\n\nXpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.\n(CVE-2022-24107)\n\nXpdf prior to version 4.04 contains an integer overflow in the JBIG2\ndecoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a\nspecially crafted PDF file or JBIG2 image could lead to a crash or the\nexecution of arbitrary code. (CVE-2022-38171)\n","status":"published","published":"2022-09-07T05:27:53Z","modified":"2026-04-16T04:41:47.162271521Z","updated_at":"2026-11-02T15:49:42.263076Z"}]}}