The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a crafted pdf file, as demonstrated by pdftoppm.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | No solution exists | May 15, 2025 | Oct 18, 2018 |
| Suse | — | Upgrade libpoppler73-32bitUpgrade libpoppler60Upgrade typelib-1_0-Poppler-0_18Upgrade libpoppler-cpp0Upgrade poppler-toolsUpgrade libpoppler-qt4-develUpgrade libpoppler-develUpgrade libpoppler-glib8Upgrade libpoppler-glib-develUpgrade libpoppler73Upgrade libpoppler-qt4-4 | Aug 9, 2024 | Oct 18, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 18, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub