The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Oct 18, 2018 |
| Suse | — | Upgrade libpoppler-qt4-4Upgrade libpoppler73Upgrade libpoppler-glib8Upgrade libpoppler-develUpgrade libpoppler-glib-develUpgrade libpoppler-qt4-develUpgrade libpoppler-cpp0Upgrade poppler-toolsUpgrade typelib-1_0-Poppler-0_18Upgrade libpoppler60Upgrade libpoppler73-32bit | Aug 9, 2024 | Oct 18, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub