CVE-2022-38334

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-383355.4Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.CVE-2022-383368.1An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without aCVE-2022-383379.1When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid loginCVE-2022-383396.1Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execCVE-2022-38344.8The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users sucCVE-2022-383407.2Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataCVE-2022-383417.1Safe Software FME Server v2021.2.5 and below does not employ server-side validation.CVE-2022-383426.5Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows aCVE-2022-383496.5An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replaCVE-2022-38354.8The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege usersCVE-2022-383518.8A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUCVE-2022-383529.8ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This
CVE-2022-38334: Medium severity, CVSS 5.5 | Vulnix