Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tetex-docUpgrade texlive-dvipsUpgrade tetex-latexUpgrade tetex-fontsUpgrade t1lib-develUpgrade texlive-utilsUpgrade kpathsea-develUpgrade mendexkUpgrade tetex-xdviUpgrade texlive-dviutilsUpgrade texlive-latexUpgrade t1lib-staticUpgrade t1lib-appsUpgrade texliveUpgrade tetex-afmUpgrade texlive-xetexUpgrade tetexUpgrade texlive-afmUpgrade tetex-dvipsUpgrade kpathseaUpgrade t1libUpgrade texlive-east-asianUpgrade texlive-context | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade tetexUpgrade tetex-xdviUpgrade texlive-east-asianUpgrade t1lib-appsUpgrade t1libUpgrade texlive-latexUpgrade texlive-xetexUpgrade kpathsea-develUpgrade tetex-afmUpgrade texlive-contextUpgrade tetex-dvipsUpgrade texliveUpgrade texlive-utilsUpgrade mendexkUpgrade t1lib-staticUpgrade kpathseaUpgrade tetex-fontsUpgrade tetex-docUpgrade texlive-afmUpgrade t1lib-develUpgrade tetex-latexUpgrade texlive-dvipsUpgrade texlive-dviutils | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1libUpgrade t1lib-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub