CVE-2022-24106

Name	CVE-2022-24106
Description	In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the first scan of the image, leading to an unknown integer-related vulnerability in Stream.cc.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	1021669

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
poppler (PTS)	buster	0.71.0-5	vulnerable
	buster (security)	0.71.0-5+deb10u1	vulnerable
	bullseye (security), bullseye	20.09.0-3.1+deb11u1	vulnerable
	bookworm, sid	22.12.0-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
poppler	source	(unstable)	(unfixed)	unimportant		1021669

https://gitlab.freedesktop.org/poppler/poppler/-/issues/1297
Code only compiled with -DENABLE_DCTDECODER=unmaintained