Description
Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.23-13 | — |
| Debian 14 | libextractor | 0.5.8-1 | — |
| Debian 14 | poppler | 0.4.2-1.1 | — |
| Debian 14 | xpdf | 3.01-3 | — |
| Debian 13 | cups | 1.1.23-13 | — |
| Debian 13 | libextractor | 0.5.8-1 | — |
| Debian 13 | poppler | 0.4.2-1.1 | — |
| Debian 13 | xpdf | 3.01-3 | — |
| Debian 12 | cups | 1.1.23-13 | — |
| Debian 12 | libextractor | 0.5.8-1 | — |
| Debian 12 | poppler | 0.4.2-1.1 | — |
| Debian 12 | xpdf | 3.01-3 | — |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge2 | DSA-982-1, DSA-940-1 |
| Debian 3.1 | kdegraphics | 4:3.3.2-2sarge3 | DSA-932-1 |
| Debian 3.1 | koffice | 1:1.3.5-4.sarge.2 | DSA-938-1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge2 | DSA-936-1 |
| Debian 3.1 | pdfkit.framework | 0.8-2sarge1 | DSA-979-1, DSA-961-1 |
| Debian 3.1 | pdftohtml | 0.36-11sarge1 | DSA-983-1, DSA-962-1 |
| Debian 3.1 | tetex-bin | 2.0.2-30sarge4 | DSA-937-1 |
| Debian 3.1 | xpdf | 3.00-13.4 | DSA-984-1, DSA-931-1 |
| Debian 3.0 | cupsys | 1.1.14-5woody14 | DSA-950-1 |
| Debian 3.0 | tetex-bin | 1.0.7+20011202-7.7 | DSA-937-1 |
| Debian 3.0 | xpdf | 1.00-3.8 | DSA-931-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.9 | RHSA-2005:878 |
| RHEL 4 | gpdf | 2.8.2-7.3 | RHSA-2005:867 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-3.6 | RHSA-2005:868 |
| RHEL 4 | tetex +6 | 2.0.2-22.EL4.7 | RHSA-2006:0160 |
| RHEL 4 | xpdf | 1:3.00-11.10 | RHSA-2005:840 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.34 | RHSA-2005:878 |
| RHEL 3 | tetex +5 | 1.0.7-67.9 | RHSA-2006:0160 |
| RHEL 3 | xpdf | 1:2.02-9.8 | RHSA-2005:840 |
Advisories 18
- RHSA-2006:0160 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:878 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:868 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:867 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:840 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-984-1 xpdf - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-983-1 pdftohtml - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-936-1 libextractor - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-962-1 pdftohtml - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-982-1 gpdf - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-932-1 kdegraphics - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-979-1 pdfkit.framework - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-938-1 koffice - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-940-1 gpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-950-1 cupsys - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-937-1 tetex-bin - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-931-1 xpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-961-1 pdfkit.framework - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
References
- 234 third-party-advisory
- 17929 third-party-advisory
- 19797 third-party-advisory
- 233 third-party-advisory
- DSA-932 vendor-advisory
- 18349 third-party-advisory
- 18147 third-party-advisory
- 18055 third-party-advisory
- http://www.kde.org/info/security/advisory-20051207-1.txt
- 18503 third-party-advisory
- 18549 third-party-advisory
- http://www.kde.org/info/security/advisory-20051207-2.txt
- 18679 third-party-advisory
- 18189 third-party-advisory
- 26413 third-party-advisory
- 17940 third-party-advisory
- oval:org.mitre.oval:def:9760 vdb-entry signature
- xpdf-dctstream-baseline-bo(23444) vdb-entry
- 18303 third-party-advisory
- DSA-931 vendor-advisory
- 18554 third-party-advisory
- MDKSA-2006:003 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289
- 19230 third-party-advisory
- 102972 vendor-advisory
- MDKSA-2006:012 vendor-advisory
- DSA-962 vendor-advisory
- 1015309 vdb-entry
- DSA-937 vendor-advisory
- 18398 third-party-advisory
- FLSA-2006:176751 vendor-advisory
- SUSE-SA:2006:001 vendor-advisory
- DSA-936 vendor-advisory
- 17916 third-party-advisory
- 20051205 Multiple Vendor xpdf DCTStream Progressive Heap Overflow third-party-advisory
- RHSA-2005:840 vendor-advisory
- ADV-2005-2789 vdb-entry
- RHSA-2005:867 vendor-advisory
- 18674 third-party-advisory
- MDKSA-2006:005 vendor-advisory
- 18313 third-party-advisory
- 15727 vdb-entry
- https://issues.rpath.com/browse/RPL-1609
- RHSA-2005:868 vendor-advisory
- 18448 third-party-advisory
- 18436 third-party-advisory
- 18428 third-party-advisory
- 18380 third-party-advisory
- GLSA-200512-08 vendor-advisory
- FEDORA-2005-1126 vendor-advisory
- 18416 third-party-advisory
- ADV-2007-2280 vdb-entry
- 15726 vdb-entry
- GLSA-200601-02 vendor-advisory
- FEDORA-2005-1142 vendor-advisory
- 18336 third-party-advisory
- 18061 third-party-advisory
- 18407 third-party-advisory
- 18009 third-party-advisory
- 17908 third-party-advisory