Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libextractorUpgrade popplerUpgrade xpdf | Jul 30, 2024 | Jul 30, 2007 |
| Freebsd | — | Upgrade kdegraphicsUpgrade pdftohtmlUpgrade xpdfUpgrade popplerUpgrade cups-baseUpgrade gpdf | Dec 10, 2025 | Jul 31, 2007 |
| Gentoo Linux | — | Upgrade app-text/poppler.Upgrade kde-base/kdegraphics.Upgrade gnustep-libs/pdfkit.Upgrade gnustep-libs/imagekits.Upgrade app-office/kword.Upgrade kde-base/kpdf.Upgrade app-office/koffice.Upgrade app-text/tetex. | Oct 30, 2017 | Jul 30, 2007 |
| Oracle_linux | — | Upgrade poppler-develUpgrade tetex-dvipsUpgrade cups-libsUpgrade tetex-afmUpgrade tetexUpgrade tetex-xdviUpgrade cupsUpgrade poppler-utilsUpgrade tetex-docUpgrade tetex-fontsUpgrade popplerUpgrade tetex-latexUpgrade cups-lpdUpgrade cups-devel | Oct 16, 2024 | Jul 30, 2007 |
| Suse | — | Upgrade cups-clientUpgrade cups-libsUpgrade xpdf-toolsUpgrade cups-libs-x86Upgrade libcupsimage2Upgrade cups-develUpgrade cups-libs-32bitUpgrade cupsUpgrade cups-configUpgrade cups-ddkUpgrade libcups2 | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libpoppler1Upgrade kword | Nov 8, 2024 | Jul 30, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub