Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade popplerUpgrade cupsUpgrade xpdfUpgrade libextractor | Jul 30, 2024 | Nov 8, 2007 |
| Freebsd | — | Upgrade kofficeUpgrade popplerUpgrade kdegraphicsUpgrade gpdfUpgrade cups-baseUpgrade xpdf | Dec 10, 2025 | Nov 12, 2007 |
| Gentoo Linux | — | Upgrade kde-base/kdegraphics.Upgrade app-office/koffice.Upgrade kde-base/kpdf.Upgrade app-office/kword.Upgrade app-text/poppler. | Oct 30, 2017 | Nov 7, 2007 |
| Oracle_linux | — | Upgrade poppler-utilsUpgrade popplerUpgrade poppler-devel | Oct 16, 2024 | Nov 8, 2007 |
| Suse | — | Upgrade cupsUpgrade cups-clientUpgrade libpoppler-glib-develUpgrade cups-libs-x86Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-qt4-develUpgrade libcups2Upgrade cups-ddkUpgrade libpoppler-qt6-3Upgrade cups-develUpgrade libpoppler-develUpgrade cups-configUpgrade libpoppler-cpp2Upgrade libpoppler-glib4Upgrade libpoppler148Upgrade libpoppler-qt4-3Upgrade libpoppler-glib8Upgrade libpoppler5Upgrade cups-libs-32bitUpgrade libpoppler-qt6-develUpgrade poppler-toolsUpgrade libcupsimage2Upgrade libpoppler-qt3-develUpgrade libpoppler-qt2Upgrade cups-libs | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade kwordUpgrade libpoppler2Upgrade libpoppler1 | Nov 8, 2024 | Nov 8, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub