Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade popplerUpgrade xpdfUpgrade cupsUpgrade libextractor | Jul 30, 2024 | Dec 31, 2005 |
| Gentoo Linux | — | Upgrade app-text/xpdf.Upgrade app-office/koffice.Upgrade app-text/poppler.Upgrade app-text/gpdf.Upgrade kde-base/kpdf.Upgrade media-libs/libextractor.Upgrade kde-base/kdegraphics.Upgrade app-text/pdftohtml.Upgrade app-office/kword. | Oct 30, 2017 | Dec 31, 2005 |
| Suse | — | Upgrade cups-clientUpgrade cups-develUpgrade libcups2Upgrade cupsUpgrade cups-configUpgrade cups-ddkUpgrade libcupsimage2 | Sep 1, 2026 | Jun 28, 2013 |
| Ubuntu | — | Upgrade cupsysUpgrade kwordUpgrade xpdf-utils | Nov 8, 2024 | Dec 31, 2005 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub