t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade t1lib-develUpgrade texlive-contextUpgrade texlive-xetexUpgrade tetex-fontsUpgrade mendexkUpgrade texliveUpgrade t1lib-staticUpgrade t1libUpgrade kpathsea-develUpgrade tetexUpgrade tetex-dvipsUpgrade t1lib-appsUpgrade texlive-dviutilsUpgrade texlive-latexUpgrade kpathseaUpgrade texlive-dvipsUpgrade texlive-afmUpgrade texlive-east-asianUpgrade tetex-xdviUpgrade texlive-utilsUpgrade tetex-latexUpgrade tetex-docUpgrade tetex-afm | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade t1lib-develUpgrade mendexkUpgrade tetex-afmUpgrade texlive-xetexUpgrade tetex-fontsUpgrade texlive-dvipsUpgrade tetex-xdviUpgrade texlive-east-asianUpgrade kpathseaUpgrade texlive-contextUpgrade tetex-dvipsUpgrade kpathsea-develUpgrade texliveUpgrade t1libUpgrade texlive-afmUpgrade tetexUpgrade tetex-latexUpgrade t1lib-appsUpgrade texlive-latexUpgrade texlive-dviutilsUpgrade t1lib-staticUpgrade texlive-utilsUpgrade tetex-doc | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1libUpgrade t1lib-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub