Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xpdfUpgrade popplerUpgrade libextractor | Jul 30, 2024 | Jul 30, 2007 |
| Freebsd | — | Upgrade pdftohtmlUpgrade cups-baseUpgrade gpdfUpgrade xpdfUpgrade popplerUpgrade kdegraphics | Dec 10, 2025 | Jul 31, 2007 |
| Gentoo Linux | — | Upgrade gnustep-libs/imagekits.Upgrade kde-base/kdegraphics.Upgrade app-text/poppler.Upgrade gnustep-libs/pdfkit.Upgrade app-text/tetex.Upgrade app-office/kword.Upgrade kde-base/kpdf.Upgrade app-office/koffice. | Oct 30, 2017 | Jul 30, 2007 |
| Oracle_linux | — | Upgrade cups-develUpgrade poppler-utilsUpgrade cups-lpdUpgrade tetex-latexUpgrade popplerUpgrade tetex-docUpgrade cupsUpgrade tetex-fontsUpgrade tetex-xdviUpgrade tetex-afmUpgrade poppler-develUpgrade tetex-dvipsUpgrade cups-libsUpgrade tetex | Oct 16, 2024 | Jul 30, 2007 |
| Suse | — | Upgrade cups-clientUpgrade xpdf-toolsUpgrade cups-libsUpgrade cups-configUpgrade cups-ddkUpgrade cups-develUpgrade cupsUpgrade libcups2Upgrade libcupsimage2Upgrade cups-libs-32bitUpgrade cups-libs-x86 | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libpoppler1Upgrade kword | Nov 8, 2024 | Jul 30, 2007 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub