CVE-2022-38334: 
NixOS vulnerability analysis and mitigation

XPDF v4.04 and earlier contains a stack overflow vulnerability identified as CVE-2022-38334, discovered in August 2022 and publicly disclosed on September 15, 2022. The vulnerability affects the Catalog::countPageTree() function in the Catalog.cc file of the XPDF PDF viewer software (NVD, CVE).

The vulnerability is classified as an Uncontrolled Recursion (CWE-674) issue that leads to a stack overflow condition. It has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local access is required and user interaction is needed (NVD).

The vulnerability primarily affects the availability of the system, as indicated by the CVSS metrics showing high impact on availability (A:H) while having no direct impact on confidentiality or integrity. When successfully exploited, it can cause the application to crash through stack overflow (NVD).

Several Linux distributions have released fixes for this vulnerability. Debian has addressed the issue in multiple releases including bullseye (3.04+git20210103-3), bookworm (3.04+git20220601-1), and sid/trixie (3.04+git20250304-1) (Debian).