The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade poppler-develUpgrade kdegraphics-develUpgrade cups-libsUpgrade gpdfUpgrade tetexUpgrade tetex-afmUpgrade tetex-dvipsUpgrade tetex-xdviUpgrade popplerUpgrade cupsUpgrade tetex-docUpgrade cups-develUpgrade poppler-utilsUpgrade xpdfUpgrade tetex-latexUpgrade kdegraphicsUpgrade tetex-fonts | Dec 1, 2016 | Jun 9, 2009 |
| Debian | — | Upgrade cups | Jul 30, 2024 | Jun 9, 2009 |
| Oracle_linux | — | Upgrade poppler-develUpgrade poppler-utilsUpgrade poppler | Oct 16, 2024 | Jun 9, 2009 |
| Suse | — | Upgrade libpoppler-glib-develUpgrade libpoppler-qt3-develUpgrade libpoppler-qt4-3Upgrade libpoppler-qt4-develUpgrade libpoppler-develUpgrade xpdf-toolsUpgrade libpoppler5Upgrade poppler-toolsUpgrade libpoppler-glib4Upgrade libpoppler-qt2Upgrade libpoppler4 | Feb 17, 2015 | Jun 28, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub