t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade texliveUpgrade t1lib-staticUpgrade mendexkUpgrade t1libUpgrade t1lib-develUpgrade texlive-xetexUpgrade tetex-fontsUpgrade texlive-contextUpgrade t1lib-appsUpgrade tetex-docUpgrade kpathseaUpgrade texlive-afmUpgrade texlive-dvipsUpgrade texlive-east-asianUpgrade texlive-latexUpgrade tetex-latexUpgrade tetex-afmUpgrade tetex-dvipsUpgrade tetexUpgrade texlive-utilsUpgrade texlive-dviutilsUpgrade kpathsea-develUpgrade tetex-xdvi | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade t1libUpgrade tetex-latexUpgrade texlive-utilsUpgrade texlive-latexUpgrade t1lib-staticUpgrade tetex-docUpgrade t1lib-appsUpgrade texlive-dviutilsUpgrade texliveUpgrade tetexUpgrade texlive-afmUpgrade texlive-dvipsUpgrade kpathsea-develUpgrade tetex-xdviUpgrade tetex-dvipsUpgrade texlive-contextUpgrade t1lib-develUpgrade texlive-east-asianUpgrade tetex-fontsUpgrade tetex-afmUpgrade kpathseaUpgrade texlive-xetexUpgrade mendexk | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1libUpgrade t1lib-debugsourceUpgrade t1lib-develUpgrade t1lib-debuginfo | Dec 12, 2013 | Mar 31, 2011 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub