Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libextractorUpgrade popplerUpgrade cupsUpgrade xpdf | Jul 30, 2024 | Nov 8, 2007 |
| Freebsd | — | Upgrade cups-baseUpgrade popplerUpgrade kofficeUpgrade xpdfUpgrade kdegraphicsUpgrade gpdf | Dec 10, 2025 | Nov 12, 2007 |
| Gentoo Linux | — | Upgrade app-office/koffice.Upgrade app-text/poppler.Upgrade kde-base/kdegraphics.Upgrade app-office/kword.Upgrade kde-base/kpdf. | Oct 30, 2017 | Nov 7, 2007 |
| Oracle_linux | — | Upgrade popplerUpgrade poppler-utilsUpgrade poppler-devel | Oct 16, 2024 | Nov 8, 2007 |
| Suse | — | Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-cpp2Upgrade libpoppler-qt6-3Upgrade libpoppler-qt4-develUpgrade cups-libs-x86Upgrade cups-clientUpgrade libpoppler157Upgrade cups-configUpgrade cupsUpgrade cups-develUpgrade cups-libs-32bitUpgrade libpoppler-qt2Upgrade libpoppler-develUpgrade libpoppler5Upgrade libcups2Upgrade libpoppler-qt3-develUpgrade poppler-toolsUpgrade libpoppler-glib4Upgrade libpoppler-glib-develUpgrade libpoppler148Upgrade libpoppler-cpp3Upgrade libcupsimage2Upgrade libpoppler-qt6-develUpgrade libpoppler-glib8Upgrade cups-ddkUpgrade cups-libsUpgrade libpoppler-qt4-3Upgrade xpdf-tools | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade libpoppler1Upgrade libpoppler2Upgrade kword | Nov 8, 2024 | Nov 8, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub