CVE-2022-45587

What it actually does

Stack-based buffer overflow in gmalloc within goo/gmem.cc of xpdf 4.04 causes memory corruption and process termination when processing crafted input.

Why it matters to the business

Local denial-of-service condition can interrupt Centreon services that rely on the embedded PDF processing component, leading to availability loss for monitoring and reporting workflows.

How an attack unfolds

An attacker with local access supplies a malicious PDF or input file that reaches gmalloc; the overflow corrupts the stack and crashes the process. No remote unauthenticated vector exists and the issue has been public for over three years with publicly available proof-of-concept code.

How to fix it

Upgrade Centreon GIT to commit 2dd129a167398b1c65a62f4e4e2ef7717bffe41b or later; rebuild and redeploy any affected packages that embed the vulnerable xpdf code.

How to confirm the fix worked

Confirm the running binary or library no longer contains the vulnerable gmalloc implementation by checking the commit hash or performing a source-level diff against 2dd129a; re-test with known triggering input to verify absence of crash.

Typical attack path

1. Obtain local shell or user session on a system running the vulnerable Centreon component
2. Place or trigger a specially crafted PDF file that Centreon processes via xpdf
3. Trigger the gmalloc call path to overflow the stack
4. Observe process crash and resulting service interruption

How to detect it

Review system and application logs for unexpected xpdf or Centreon process terminations, segmentation faults, or stack overflow signals around the time of reported service disruption.

What your security team should do

• Apply the referenced commit immediately on all Centreon GIT deployments
• Harden local access controls and restrict PDF processing privileges where possible
• Monitor for process crashes in xpdf-related components while the fix is deployed