The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Oct 18, 2018 |
| Suse | — | Upgrade libpoppler-cpp0Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler73-32bitUpgrade libpoppler60Upgrade poppler-toolsUpgrade libpoppler-qt4-4Upgrade libpoppler-qt4-develUpgrade libpoppler-glib8Upgrade libpoppler73Upgrade libpoppler-glib-develUpgrade libpoppler-devel | Aug 9, 2024 | Oct 18, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub