CVE-2022-38349

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Aug 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-38354.8The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2022-383518.8A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PU CVE-2022-383529.8ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This CVE-2022-383555.5Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area networ CVE-2022-383568.8Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.CVE-2022-383578.8Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url CVE-2022-383586.1Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting at CVE-2022-383598.8Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections CVE-2022-38364.8The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2022-383628.8Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of co CVE-2022-383675.3The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user CVE-2022-383688.8An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authenticatio