Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A NULL pointer dereference vulnerability exists in PDFParser::CreateFilterForStream() when processing a PDF stream with /Filter /LZWDecode and a /DecodeParms dictionary that does not contain the EarlyChange key. This causes an access violation (0xC0000005) and crashes the process. Affected Version muhammara <= 6.0.4 (latest) Vulnerability Details File: src/deps/PDFWriter/PDFParser.cpp line 2107 When inDecodeParams is non-NULL but lacks the EarlyChange key: 1. QueryDictionaryObject() returns NULL 2. PDFObjectCastPtr<PDFInteger(NULL) wraps NULL 3. earlyObj-GetValue() dereferences NULL → crash PoC 460-byte malicious PDF triggers crash via startReadingFromStream(): - PDF contains /Filter /LZWDecode with /DecodeParms << (empty, no EarlyChange) - Exit code: 0xC0000005 (Access Violation) Fix Impact Any application accepting untrusted PDFs and using muhammara to read stream contents is vulnerable to DoS. Similar to: CVE-2022-41957, CVE-2022-39381 PoC File pocmuhammaralzwnull.js
Recommended action: Upgrade to 6.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another. Patches It has been patched in 2.6.0 for muhammara and not at all for hummus Workarounds Do not process files from untrusted sources References PR: https://github.com/julianhille/MuhammaraJS/pull/194 Issue: https://github.com/julianhille/MuhammaraJS/issues/191 Issue in hummus: https://github.com/galkahana/HummusJS/issues/293 Outline differences to https://nvd.nist.gov/vuln/detail/CVE-2022-25892 The difference is one is in src/deps/PDFWriter/PDFParser.cpp and the other is PDFDocumentHandler.cpp both is a null pointer but for different cases These are totally diffent issues, one is in reading a pdf the other is in appendending a maliciously crafted one. The function calls are different the versions in which they are solved are diffent.
Recommended action: Upgrade to 2.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed. Patches It has been patched in 3.1.1 and has been backported to 2.6.1 Hummus has a patch in 1.0.111. Workarounds Do not process files from untrusted sources or update. References https://nvd.nist.gov/vuln/detail/CVE-2022-25892 https://github.com/galkahana/HummusJS/issues/463 https://github.com/julianhille/MuhammaraJS/issues/214 https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002 https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51 https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138 https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320
Recommended action: Upgrade to 3.1.1 or 2.6.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
Recommended action: Upgrade to 2.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.