The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade texlive-xetexUpgrade tetex-dvipsUpgrade t1lib-appsUpgrade t1libUpgrade texliveUpgrade texlive-dviutilsUpgrade texlive-latexUpgrade tetexUpgrade texlive-dvipsUpgrade texlive-contextUpgrade t1lib-staticUpgrade texlive-afmUpgrade texlive-east-asianUpgrade tetex-afmUpgrade kpathseaUpgrade texlive-utilsUpgrade mendexkUpgrade tetex-fontsUpgrade tetex-latexUpgrade tetex-xdviUpgrade t1lib-develUpgrade kpathsea-develUpgrade tetex-doc | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade tetexUpgrade kpathseaUpgrade texliveUpgrade texlive-east-asianUpgrade texlive-afmUpgrade tetex-afmUpgrade texlive-latexUpgrade tetex-dvipsUpgrade kpathsea-develUpgrade t1libUpgrade texlive-utilsUpgrade tetex-xdviUpgrade texlive-xetexUpgrade t1lib-appsUpgrade tetex-latexUpgrade texlive-dviutilsUpgrade texlive-dvipsUpgrade texlive-contextUpgrade t1lib-develUpgrade t1lib-staticUpgrade tetex-fontsUpgrade mendexkUpgrade tetex-doc | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1lib-develUpgrade t1lib | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub