Description
Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.22-6 | — |
| Debian 14 | xpdf | 3.00-9 | — |
| Debian 13 | cups | 1.1.22-6 | — |
| Debian 13 | xpdf | 3.00-9 | — |
| Debian 12 | cups | 1.1.22-6 | — |
| Debian 12 | xpdf | 3.00-9 | — |
| Debian 3.0 | cupsys | 1.1.14-5woody10 | DSA-573-1 |
| Debian 3.0 | tetex-bin | 1.0.7+20011202-7.3 | DSA-599-1 |
| Debian 3.0 | xpdf | 1.00-3.2 | DSA-581-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kdegraphics +1 | 7:3.3.1-3.3 | RHSA-2005:066 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.16 | RHSA-2004:543 |
| RHEL 3 | tetex +5 | 1.0.7-67.7 | RHSA-2005:354 |
| RHEL 3 | xpdf | 1:2.02-9.3 | RHSA-2004:592 |
Advisories 7
- RHSA-2005:354 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:066 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:592 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2004:543 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-599-1 tetex-bin - integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-573-1 cupsys - integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-581-1 xpdf - integer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2004:592 vendor-advisory
- 11501 vdb-entry
- RHSA-2005:066 vendor-advisory
- USN-9-1 vendor-advisory
- MDKSA-2004:113 vendor-advisory
- GLSA-200410-20 vendor-advisory
- DSA-581 vendor-advisory
- DSA-573 vendor-advisory
- FLSA:2353 vendor-advisory
- MDKSA-2004:116 vendor-advisory
- DSA-599 vendor-advisory
- xpdf-pdf-bo(17818) vdb-entry
- RHSA-2005:354 vendor-advisory
- RHSA-2004:543 vendor-advisory
- oval:org.mitre.oval:def:9714 vdb-entry signature
- CLA-2004:886 vendor-advisory
- MDKSA-2004:114 vendor-advisory
- GLSA-200410-30 vendor-advisory
- MDKSA-2004:115 vendor-advisory
- SUSE-SA:2004:039 vendor-advisory
- FLSA:2352 vendor-advisory