The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Openoffice | — | Upgrade Apache OpenOffice to the latest version | Sep 12, 2025 | Nov 5, 2010 |
| Centos_linux | — | Upgrade tetexUpgrade poppler-utilsUpgrade popplerUpgrade gpdfUpgrade tetex-afmUpgrade kdegraphics-develUpgrade xpdfUpgrade tetex-dvipsUpgrade kdegraphicsUpgrade poppler-develUpgrade tetex-xdviUpgrade tetex-docUpgrade tetex-fontsUpgrade tetex-latex | Dec 1, 2016 | Nov 5, 2010 |
| Debian | — | Upgrade xpdfUpgrade poppler | Jul 30, 2024 | Nov 5, 2010 |
| Gentoo Linux | — | Upgrade app-text/poppler.Upgrade app-text/xpdf. | Oct 30, 2017 | Nov 5, 2010 |
| Oracle_linux | — | Upgrade tetex-dvipsUpgrade tetex-afmUpgrade poppler-develUpgrade tetexUpgrade poppler-qt4Upgrade poppler-utilsUpgrade tetex-docUpgrade tetex-xdviUpgrade poppler-qtUpgrade poppler-glibUpgrade poppler-glib-develUpgrade poppler-qt4-develUpgrade tetex-fontsUpgrade poppler-qt-develUpgrade popplerUpgrade tetex-latex | Oct 16, 2024 | Nov 5, 2010 |
| Suse | — | Upgrade libreoffice-impress-extensionsUpgrade libpoppler-qt3-develUpgrade libreoffice-drawUpgrade poppler-toolsUpgrade libpoppler-glib4Upgrade libreoffice-l10n-prebuiltUpgrade libreoffice-monoUpgrade libpoppler-qt4-3Upgrade libpoppler4Upgrade libpoppler-qt2Upgrade libreoffice-kde4Upgrade libreofficeUpgrade libreoffice-testtoolUpgrade libreoffice-calc-extensionsUpgrade libreoffice-impressUpgrade libreoffice-sdkUpgrade libpoppler-qt4-develUpgrade libreoffice-writer-extensionsUpgrade libreoffice-kdeUpgrade libreoffice-mailmergeUpgrade libreoffice-draw-extensionsUpgrade libreoffice-mathUpgrade libpoppler-glib-develUpgrade libreoffice-base-extensionsUpgrade libreoffice-filters-optionalUpgrade libreoffice-officebeanUpgrade libreoffice-pyunoUpgrade libpoppler-develUpgrade libreoffice-calcUpgrade libpoppler5Upgrade libreoffice-base-drivers-postgresqlUpgrade libreoffice-baseUpgrade libreoffice-writerUpgrade libreoffice-gnome | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpoppler-glib4Upgrade libpoppler4Upgrade libpoppler1Upgrade libpoppler-glib2Upgrade libpoppler-glib5Upgrade libpoppler1-glibUpgrade libpoppler2Upgrade libpoppler5Upgrade libpoppler7 | Nov 8, 2024 | Nov 5, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub