Description
Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.23-13 | — |
| Debian 14 | libextractor | 0.5.8-1 | — |
| Debian 14 | poppler | 0.4.3-2 | — |
| Debian 14 | xpdf | 3.01-3 | — |
| Debian 13 | cups | 1.1.23-13 | — |
| Debian 13 | libextractor | 0.5.8-1 | — |
| Debian 13 | poppler | 0.4.3-2 | — |
| Debian 13 | xpdf | 3.01-3 | — |
| Debian 12 | cups | 1.1.23-13 | — |
| Debian 12 | libextractor | 0.5.8-1 | — |
| Debian 12 | poppler | 0.4.3-2 | — |
| Debian 12 | xpdf | 3.01-3 | — |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge2 | DSA-940-1 |
| Debian 3.1 | kdegraphics | 4:3.3.2-2sarge3 | DSA-932-1 |
| Debian 3.1 | koffice | 1.3.5-4.sarge.3 | DSA-1019-1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge2 | DSA-936-1 |
| Debian 3.1 | pdfkit.framework | 0.8-2sarge1 | DSA-961-1 |
| Debian 3.1 | pdftohtml | 0.36-11sarge1 | DSA-983-1, DSA-962-1 |
| Debian 3.1 | tetex-bin | 2.0.2-30sarge4 | DSA-937-1 |
| Debian 3.1 | xpdf | 3.00-13.4 | DSA-931-1 |
| Debian 3.0 | cupsys | 1.1.14-5woody14 | DSA-950-1 |
| Debian 3.0 | tetex-bin | 1.0.7+20011202-7.7 | DSA-937-1 |
| Debian 3.0 | xpdf | 1.00-3.8 | DSA-931-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.9 | RHSA-2005:878 |
| RHEL 4 | gpdf | 2.8.2-7.3 | RHSA-2005:867 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-3.6 | RHSA-2005:868 |
| RHEL 4 | tetex +6 | 2.0.2-22.EL4.7 | RHSA-2006:0160 |
| RHEL 4 | xpdf | 1:3.00-11.10 | RHSA-2005:840 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.34 | RHSA-2005:878 |
| RHEL 3 | tetex +5 | 1.0.7-67.9 | RHSA-2006:0160 |
| RHEL 3 | xpdf | 1:2.02-9.8 | RHSA-2005:840 |
Advisories 15
- RHSA-2006:0160 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:878 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:868 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:867 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:840 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-983-1 pdftohtml - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-936-1 libextractor - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-962-1 pdftohtml - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-932-1 kdegraphics - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-940-1 gpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-950-1 cupsys - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-937-1 tetex-bin - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-931-1 xpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-961-1 pdfkit.framework - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1019-1 koffice - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 17929 third-party-advisory
- 19797 third-party-advisory
- xpdf-streampredictor-bo(23442) vdb-entry
- DSA-932 vendor-advisory
- 18349 third-party-advisory
- 18055 third-party-advisory
- http://scary.beasts.org/security/CESA-2005-003.txt
- http://www.kde.org/info/security/advisory-20051207-1.txt
- 18503 third-party-advisory
- oval:org.mitre.oval:def:10914 vdb-entry signature
- 18549 third-party-advisory
- http://www.kde.org/info/security/advisory-20051207-2.txt
- 18679 third-party-advisory
- 18189 third-party-advisory
- 26413 third-party-advisory
- 17940 third-party-advisory
- 18303 third-party-advisory
- DSA-931 vendor-advisory
- 18554 third-party-advisory
- MDKSA-2006:003 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289
- 19230 third-party-advisory
- 102972 vendor-advisory
- DSA-962 vendor-advisory
- 1015309 vdb-entry
- 18398 third-party-advisory
- FLSA-2006:176751 vendor-advisory
- SUSE-SA:2006:001 vendor-advisory
- DSA-936 vendor-advisory
- 17916 third-party-advisory
- RHSA-2005:840 vendor-advisory
- ADV-2005-2789 vdb-entry
- RHSA-2005:867 vendor-advisory
- 18674 third-party-advisory
- MDKSA-2006:005 vendor-advisory
- 18313 third-party-advisory
- https://issues.rpath.com/browse/RPL-1609
- RHSA-2005:868 vendor-advisory
- 18448 third-party-advisory
- 18436 third-party-advisory
- 18428 third-party-advisory
- 18380 third-party-advisory
- GLSA-200512-08 vendor-advisory
- FEDORA-2005-1126 vendor-advisory
- 18416 third-party-advisory
- ADV-2007-2280 vdb-entry
- GLSA-200601-02 vendor-advisory
- FEDORA-2005-1142 vendor-advisory
- 18336 third-party-advisory
- 18061 third-party-advisory
- 18407 third-party-advisory
- 18009 third-party-advisory
- 17908 third-party-advisory
- USN-227-1 vendor-advisory
- 18517 third-party-advisory
- 18582 third-party-advisory
- SUSE-SR:2006:002 vendor-advisory
- 18534 third-party-advisory
- 20051205 Multiple Vendor xpdf StreamPredictor Heap Overflow Vulnerability third-party-advisory
- SSA:2006-045-09 vendor-advisory