Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade cupsUpgrade xpdf | Jul 30, 2024 | May 2, 2005 |
| Freebsd | — | Upgrade kofficeUpgrade cups-baseUpgrade gpdfUpgrade pdftohtmlUpgrade kdegraphicsUpgrade xpdfUpgrade teTeX-base | Dec 10, 2025 | Jan 26, 2005 |
| Gentoo Linux | — | Upgrade net-print/cups.Upgrade app-text/gpdf.Upgrade app-text/tetex.Upgrade app-text/pdftohtml.Upgrade app-text/ptex.Upgrade media-libs/libextractor.Upgrade app-text/xpdf.Upgrade app-text/cstetex.Upgrade app-office/koffice.Upgrade kde-base/kdegraphics. | Oct 30, 2017 | May 2, 2005 |
| Suse | — | Upgrade cups-libsUpgrade cups-clientUpgrade cups-libs-64bitUpgrade cups-libs-x86Upgrade cups-develUpgrade cupsUpgrade cups-libs-32bit | Feb 17, 2015 | May 2, 2005 |
| Ubuntu | — | Upgrade xpdf-utilsUpgrade cupsys | Nov 8, 2024 | May 2, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub