Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kpathsea-develUpgrade texliveUpgrade tetex-afmUpgrade texlive-afmUpgrade tetex-dvipsUpgrade tetexUpgrade texlive-xetexUpgrade t1libUpgrade texlive-east-asianUpgrade texlive-contextUpgrade texlive-latexUpgrade t1lib-appsUpgrade tetex-xdviUpgrade kpathseaUpgrade texlive-utilsUpgrade texlive-dvipsUpgrade tetex-latexUpgrade tetex-docUpgrade tetex-fontsUpgrade t1lib-staticUpgrade texlive-dviutilsUpgrade mendexkUpgrade t1lib-devel | Dec 1, 2016 | Mar 31, 2011 |
| Debian | — | Upgrade xpdf | Jul 30, 2024 | Mar 31, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Mar 31, 2011 |
| Oracle_linux | — | Upgrade t1lib-staticUpgrade texlive-dviutilsUpgrade texlive-latexUpgrade texlive-utilsUpgrade t1lib-appsUpgrade tetex-afmUpgrade tetex-docUpgrade texlive-east-asianUpgrade texliveUpgrade t1libUpgrade tetexUpgrade texlive-afmUpgrade texlive-xetexUpgrade tetex-dvipsUpgrade kpathseaUpgrade t1lib-develUpgrade kpathsea-develUpgrade tetex-xdviUpgrade tetex-fontsUpgrade mendexkUpgrade texlive-contextUpgrade tetex-latexUpgrade texlive-dvips | Oct 16, 2024 | Mar 31, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 28, 2011 |
| Suse | — | Upgrade t1lib-debuginfoUpgrade t1lib-develUpgrade t1libUpgrade t1lib-debugsource | Dec 12, 2013 | Mar 31, 2011 |
| Ubuntu | — | Upgrade libt1-5 | Nov 8, 2024 | Mar 31, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub