The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xpdfUpgrade popplerUpgrade cupsUpgrade libextractor | Jul 30, 2024 | Dec 31, 2005 |
| Gentoo Linux | — | Upgrade app-office/koffice.Upgrade app-text/xpdf.Upgrade app-text/poppler.Upgrade app-text/gpdf.Upgrade kde-base/kdegraphics.Upgrade media-libs/libextractor.Upgrade app-text/pdftohtml.Upgrade kde-base/kpdf.Upgrade app-office/kword. | Oct 30, 2017 | Dec 31, 2005 |
| Suse | — | Upgrade libcupsimage2Upgrade cups-clientUpgrade cups-ddkUpgrade cupsUpgrade libcups2Upgrade cups-configUpgrade cups-devel | Sep 1, 2026 | Jun 28, 2013 |
| Ubuntu | — | Upgrade kwordUpgrade cupsysUpgrade xpdf-utils | Nov 8, 2024 | Dec 31, 2005 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub