t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade texliveUpgrade texlive-xetexUpgrade t1lib-develUpgrade tetex-fontsUpgrade mendexkUpgrade t1libUpgrade t1lib-staticUpgrade texlive-contextUpgrade t1lib-appsUpgrade kpathsea-develUpgrade tetex-dvipsUpgrade texlive-afmUpgrade texlive-latexUpgrade tetex-afmUpgrade tetex-latexUpgrade texlive-utilsUpgrade tetex-docUpgrade texlive-dvipsUpgrade texlive-east-asianUpgrade kpathseaUpgrade tetexUpgrade tetex-xdviUpgrade texlive-dviutils | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade tetex-xdviUpgrade texlive-xetexUpgrade tetex-dvipsUpgrade texlive-contextUpgrade kpathseaUpgrade kpathsea-develUpgrade texlive-east-asianUpgrade tetex-afmUpgrade mendexkUpgrade t1lib-develUpgrade texlive-dvipsUpgrade tetex-fontsUpgrade t1lib-appsUpgrade tetexUpgrade texlive-afmUpgrade texlive-latexUpgrade texliveUpgrade texlive-utilsUpgrade t1libUpgrade t1lib-staticUpgrade tetex-docUpgrade texlive-dviutilsUpgrade tetex-latex | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1lib-develUpgrade t1lib | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub