Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade tetex-fontsUpgrade mendexkUpgrade tetex-latexUpgrade tetex-docUpgrade texlive-utilsUpgrade tetex-xdviUpgrade t1lib-develUpgrade kpathsea-develUpgrade texlive-dvipsUpgrade kpathseaUpgrade tetex-dvipsUpgrade texlive-contextUpgrade tetexUpgrade t1lib-appsUpgrade texlive-latexUpgrade tetex-afmUpgrade t1lib-staticUpgrade texlive-xetexUpgrade texlive-dviutilsUpgrade texlive-east-asianUpgrade texliveUpgrade t1libUpgrade texlive-afm | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade t1lib-appsUpgrade texlive-contextUpgrade tetex-dvipsUpgrade texlive-east-asianUpgrade texlive-xetexUpgrade kpathsea-develUpgrade t1libUpgrade texliveUpgrade texlive-latexUpgrade tetex-xdviUpgrade tetexUpgrade tetex-afmUpgrade texlive-utilsUpgrade t1lib-staticUpgrade tetex-fontsUpgrade kpathseaUpgrade t1lib-develUpgrade mendexkUpgrade tetex-docUpgrade tetex-latexUpgrade texlive-afmUpgrade texlive-dvipsUpgrade texlive-dviutils | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1lib-develUpgrade t1lib | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub