t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade texlive-xetexUpgrade t1lib-staticUpgrade t1lib-develUpgrade texlive-contextUpgrade mendexkUpgrade texliveUpgrade tetex-fontsUpgrade t1libUpgrade t1lib-appsUpgrade tetexUpgrade texlive-latexUpgrade tetex-dvipsUpgrade texlive-dviutilsUpgrade kpathsea-develUpgrade texlive-afmUpgrade texlive-dvipsUpgrade kpathseaUpgrade tetex-xdviUpgrade texlive-east-asianUpgrade texlive-utilsUpgrade tetex-latexUpgrade tetex-afmUpgrade tetex-doc | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade t1libUpgrade texlive-dviutilsUpgrade t1lib-appsUpgrade t1lib-staticUpgrade tetexUpgrade tetex-latexUpgrade texlive-latexUpgrade tetex-docUpgrade texlive-afmUpgrade texliveUpgrade texlive-utilsUpgrade kpathsea-develUpgrade t1lib-develUpgrade texlive-contextUpgrade texlive-east-asianUpgrade tetex-fontsUpgrade tetex-dvipsUpgrade tetex-afmUpgrade mendexkUpgrade texlive-dvipsUpgrade tetex-xdviUpgrade texlive-xetexUpgrade kpathsea | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1lib-debugsourceUpgrade t1libUpgrade t1lib-develUpgrade t1lib-debuginfo | Dec 12, 2013 | Mar 31, 2011 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub