Description
Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xpdf | 3.00-10 | — |
| Debian 13 | xpdf | 3.00-10 | — |
| Debian 12 | xpdf | 3.00-10 | — |
References
- 11501 vdb-entry
- MDKSA-2004:113 vendor-advisory
- GLSA-200410-20 vendor-advisory
- GLSA-200410-30 vendor-advisory
- xpdf-pdf-file-bo(17819) vdb-entry
- SUSE-SA:2004:039 vendor-advisory