Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade texlive-xetexUpgrade t1lib-appsUpgrade tetex-xdviUpgrade texlive-latexUpgrade tetex-afmUpgrade texlive-contextUpgrade texlive-east-asianUpgrade t1libUpgrade tetex-dvipsUpgrade texlive-afmUpgrade texliveUpgrade tetexUpgrade kpathsea-develUpgrade t1lib-staticUpgrade t1lib-develUpgrade texlive-dvipsUpgrade tetex-latexUpgrade texlive-utilsUpgrade tetex-fontsUpgrade tetex-docUpgrade texlive-dviutilsUpgrade kpathseaUpgrade mendexk | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade kpathsea-develUpgrade tetex-fontsUpgrade kpathseaUpgrade tetex-dvipsUpgrade texlive-dvipsUpgrade mendexkUpgrade t1lib-develUpgrade texlive-xetexUpgrade texlive-contextUpgrade tetex-latexUpgrade tetex-xdviUpgrade texlive-dviutilsUpgrade tetex-docUpgrade texlive-east-asianUpgrade t1libUpgrade tetex-afmUpgrade texlive-latexUpgrade t1lib-appsUpgrade t1lib-staticUpgrade texliveUpgrade tetexUpgrade texlive-afmUpgrade texlive-utils | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1libUpgrade t1lib-devel | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub