The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tetex-latexUpgrade tetex-docUpgrade gpdfUpgrade cupsUpgrade cups-lpdUpgrade cups-develUpgrade kdegraphicsUpgrade popplerUpgrade tetexUpgrade cups-libsUpgrade xpdfUpgrade tetex-afmUpgrade tetex-dvipsUpgrade poppler-utilsUpgrade tetex-fontsUpgrade poppler-develUpgrade kdegraphics-develUpgrade tetex-xdvi | Dec 1, 2016 | Apr 23, 2009 |
| Debian | — | Upgrade popplerUpgrade xpdf | Jul 30, 2024 | Apr 23, 2009 |
| Freebsd | — | Upgrade xpdfUpgrade cups-base | Dec 10, 2025 | May 7, 2009 |
| Gentoo Linux | — | Upgrade app-text/poppler.Upgrade net-print/cups. | Oct 30, 2017 | Apr 23, 2009 |
| Oracle_linux | — | Upgrade cups-libsUpgrade cups-develUpgrade tetexUpgrade tetex-docUpgrade popplerUpgrade tetex-afmUpgrade cups-lpdUpgrade poppler-utilsUpgrade poppler-develUpgrade cupsUpgrade tetex-xdviUpgrade tetex-dvipsUpgrade tetex-fontsUpgrade tetex-latex | Oct 16, 2024 | Apr 23, 2009 |
| Suse | — | Upgrade libpoppler4 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpoppler2Upgrade libpoppler1-glibUpgrade libpoppler1Upgrade libpoppler3Upgrade libpoppler-glib2Upgrade kwordUpgrade libpoppler-glib3 | Nov 8, 2024 | Apr 23, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub