The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Oct 18, 2018 |
| Suse | — | Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler73-32bitUpgrade libpoppler-cpp0Upgrade poppler-toolsUpgrade libpoppler60Upgrade libpoppler-glib-develUpgrade libpoppler73Upgrade libpoppler-qt4-4Upgrade libpoppler-glib8Upgrade libpoppler-qt4-develUpgrade libpoppler-devel | Aug 9, 2024 | Oct 18, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub