The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade popplerUpgrade xpdf | Jul 30, 2024 | Jan 9, 2007 |
| Suse | — | Upgrade cups-develUpgrade libpoppler-qt4-3Upgrade libpoppler-cpp3Upgrade libcupsimage2Upgrade libpoppler-cpp2Upgrade libpoppler-glib-develUpgrade libpoppler-develUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-qt6-3Upgrade libpoppler-glib8Upgrade libpoppler-qt3-develUpgrade libpoppler157Upgrade libpoppler5Upgrade libpoppler148Upgrade cups-libs-32bitUpgrade libcups2Upgrade cups-clientUpgrade libpoppler-glib4Upgrade cups-libsUpgrade libpoppler-qt4-develUpgrade poppler-toolsUpgrade libpoppler-qt6-develUpgrade cups-libs-x86Upgrade cups-configUpgrade cupsUpgrade cups-ddkUpgrade xpdf-toolsUpgrade libpoppler-qt2 | Feb 17, 2015 | Jun 27, 2013 |
| Ubuntu | — | Upgrade kpdfUpgrade libpoppler0c2Upgrade libpoppler1Upgrade kwordUpgrade tetex-bin | Nov 8, 2024 | Jan 9, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub