Description
Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.23-13 | — |
| Debian 14 | libextractor | 0.5.8-1 | — |
| Debian 14 | poppler | 0.4.2-1.1 | — |
| Debian 14 | xpdf | 3.01-3 | — |
| Debian 13 | cups | 1.1.23-13 | — |
| Debian 13 | libextractor | 0.5.8-1 | — |
| Debian 13 | poppler | 0.4.2-1.1 | — |
| Debian 13 | xpdf | 3.01-3 | — |
| Debian 12 | cups | 1.1.23-13 | — |
| Debian 12 | libextractor | 0.5.8-1 | — |
| Debian 12 | poppler | 0.4.2-1.1 | — |
| Debian 12 | xpdf | 3.01-3 | — |
| Debian 4.0 | gpdf | 2.10.0-1+etch1 | DTSA-28-1 |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge4 | DSA-982-1 |
| Debian 3.1 | kdegraphics | 4:3.3.2-2sarge3 | DSA-932-1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge2 | DSA-936-1 |
| Debian 3.1 | pdfkit.framework | 0.8-2sarge1 | DSA-979-1, DSA-961-1 |
| Debian 3.1 | tetex-bin | 2.0.2-30sarge4 | DSA-937-1 |
| Debian 3.1 | xpdf | 3.00-13.4 | DSA-984-1, DSA-931-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.9 | RHSA-2005:878 |
| RHEL 4 | gpdf | 2.8.2-7.3 | RHSA-2005:867 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-3.6 | RHSA-2005:868 |
| RHEL 4 | tetex +6 | 2.0.2-22.EL4.7 | RHSA-2006:0160 |
| RHEL 4 | xpdf | 1:3.00-11.10 | RHSA-2005:840 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.34 | RHSA-2005:878 |
| RHEL 3 | tetex +5 | 1.0.7-67.9 | RHSA-2006:0160 |
| RHEL 3 | xpdf | 1:2.02-9.8 | RHSA-2005:840 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cups | 2.3.3op2-4.2 | openSUSE-SU-2024:10707-1 |
Advisories 16
- RHSA-2006:0160 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:878 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:868 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:867 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:840 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-984-1 xpdf - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-936-1 libextractor - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-982-1 gpdf - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-932-1 kdegraphics - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-979-1 pdfkit.framework - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-950-1 cupsys - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-937-1 tetex-bin - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-931-1 xpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-961-1 pdfkit.framework - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-28-1 gpdf - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10707-1 cups-2.3.3op2-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 17959 third-party-advisory
- 17929 third-party-advisory
- 19797 third-party-advisory
- DSA-932 vendor-advisory
- 18349 third-party-advisory
- 18147 third-party-advisory
- 18055 third-party-advisory
- http://www.kde.org/info/security/advisory-20051207-1.txt
- http://www.kde.org/info/security/advisory-20051207-2.txt
- 18679 third-party-advisory
- 18189 third-party-advisory
- 26413 third-party-advisory
- 17940 third-party-advisory
- 18303 third-party-advisory
- DSA-931 vendor-advisory
- 18554 third-party-advisory
- MDKSA-2006:003 vendor-advisory
- 19230 third-party-advisory
- 102972 vendor-advisory
- MDKSA-2006:012 vendor-advisory
- DSA-962 vendor-advisory
- FEDORA-2005-1171 vendor-advisory
- 1015309 vdb-entry
- DSA-937 vendor-advisory
- 18398 third-party-advisory
- FLSA-2006:176751 vendor-advisory
- 15721 vdb-entry
- SUSE-SA:2006:001 vendor-advisory
- DSA-936 vendor-advisory
- 17916 third-party-advisory
- 236 third-party-advisory
- GLSA-200603-02 vendor-advisory
- RHSA-2005:840 vendor-advisory
- ADV-2005-2789 vdb-entry
- RHSA-2005:867 vendor-advisory
- 18674 third-party-advisory
- MDKSA-2006:005 vendor-advisory
- 18313 third-party-advisory
- https://issues.rpath.com/browse/RPL-1609
- RHSA-2005:868 vendor-advisory
- 18448 third-party-advisory
- 18380 third-party-advisory
- GLSA-200512-08 vendor-advisory
- FEDORA-2005-1126 vendor-advisory
- 18416 third-party-advisory
- FEDORA-2005-1132 vendor-advisory
- ADV-2007-2280 vdb-entry
- GLSA-200601-02 vendor-advisory
- 19125 third-party-advisory
- xpdf-jpx-stream-bo(23441) vdb-entry
- FEDORA-2005-1142 vendor-advisory
- 18336 third-party-advisory
- 18061 third-party-advisory
- 18407 third-party-advisory
- 18009 third-party-advisory
- USN-227-1 vendor-advisory
- 17897 third-party-advisory
- 18517 third-party-advisory
- 18582 third-party-advisory
- 18534 third-party-advisory