Description
Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local users to execute arbitrary code via a ColorSpace entry with a large number of elements, as demonstrated by cups-pdf.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-222 xpdf - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-232 cupsys - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-232 vendor-advisory
- RHSA-2002:295 vendor-advisory
- MDKSA-2003:002 vendor-advisory
- SUSE-SA:2003:002 vendor-advisory
- 6475 vdb-entry
- MDKSA-2003:001 vendor-advisory
- GLSA-200301-1 vendor-advisory
- http://www.idefense.com/advisory/12.23.02.txt
- RHSA-2002:307 vendor-advisory
- pdftops-integer-overflow(10937) vdb-entry
- RHSA-2003:216 vendor-advisory
- DSA-226 vendor-advisory
- RHSA-2003:037 vendor-advisory
- DSA-222 vendor-advisory