Description
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.22-7 | — |
| Debian 14 | libextractor | 0.5.9-1 | — |
| Debian 14 | poppler | 0.4.4-1 | — |
| Debian 14 | xpdf | 3.01-4 | — |
| Debian 13 | cups | 1.1.22-7 | — |
| Debian 13 | libextractor | 0.5.9-1 | — |
| Debian 13 | poppler | 0.4.4-1 | — |
| Debian 13 | xpdf | 3.01-4 | — |
| Debian 12 | cups | 1.1.22-7 | — |
| Debian 12 | libextractor | 0.5.9-1 | — |
| Debian 12 | poppler | 0.4.4-1 | — |
| Debian 12 | xpdf | 3.01-4 | — |
| Debian 4.0 | gpdf | 2.10.0-1+etch1 | DTSA-28-1 |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge2 | DSA-940-1 |
| Debian 3.1 | kdegraphics | 4:3.3.2-2sarge3 | DSA-932-1 |
| Debian 3.1 | koffice | 1:1.3.5-4.sarge.2 | DSA-938-1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge2 | DSA-936-1 |
| Debian 3.1 | pdfkit.framework | 0.8-2sarge1 | DSA-961-1 |
| Debian 3.1 | pdftohtml | 0.36-11sarge1 | DSA-962-1 |
| Debian 3.1 | tetex-bin | 2.0.2-30sarge4 | DSA-937-1 |
| Debian 3.1 | xpdf | 3.00-13.4 | DSA-931-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.10 | RHSA-2006:0163 |
| RHEL 4 | gpdf | 2.8.2-7.4 | RHSA-2006:0177 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-3.6 | RHSA-2005:868 |
| RHEL 4 | tetex +6 | 2.0.2-22.EL4.7 | RHSA-2006:0160 |
| RHEL 4 | xpdf | 1:3.00-11.10 | RHSA-2005:840 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.36 | RHSA-2006:0163 |
| RHEL 3 | tetex +5 | 1.0.7-67.9 | RHSA-2006:0160 |
| RHEL 3 | xpdf | 1:2.02-9.8 | RHSA-2005:840 |
Advisories 15
- RHSA-2006:0177 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0163 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0160 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:868 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:840 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-936-1 libextractor - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-962-1 pdftohtml - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-932-1 kdegraphics - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-938-1 koffice - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-940-1 gpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-950-1 cupsys - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-937-1 tetex-bin - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-931-1 xpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-961-1 pdfkit.framework - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-28-1 gpdf - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 16143 vdb-entry
- DSA-932 vendor-advisory
- 18349 third-party-advisory
- oval:org.mitre.oval:def:9575 vdb-entry signature
- 18147 third-party-advisory
- http://scary.beasts.org/security/CESA-2005-003.txt
- http://www.kde.org/info/security/advisory-20051207-2.txt
- 18679 third-party-advisory
- 18312 third-party-advisory
- 18644 third-party-advisory
- USN-236-1 vendor-advisory
- 18425 third-party-advisory
- 18373 third-party-advisory
- 18303 third-party-advisory
- DSA-931 vendor-advisory
- 18554 third-party-advisory
- MDKSA-2006:003 vendor-advisory
- 19230 third-party-advisory
- 102972 vendor-advisory
- MDKSA-2006:012 vendor-advisory
- DSA-962 vendor-advisory
- http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html
- RHSA-2006:0163 vendor-advisory
- DSA-937 vendor-advisory
- 18398 third-party-advisory
- FLSA-2006:176751 vendor-advisory
- 2006-0002 vendor-advisory
- SUSE-SA:2006:001 vendor-advisory
- DSA-936 vendor-advisory
- FEDORA-2005-026 vendor-advisory
- 18329 third-party-advisory
- 18463 third-party-advisory
- 18642 third-party-advisory
- 18674 third-party-advisory
- MDKSA-2006:005 vendor-advisory
- 18313 third-party-advisory
- 18448 third-party-advisory
- 18436 third-party-advisory
- 18428 third-party-advisory
- 18380 third-party-advisory
- 18423 third-party-advisory
- 18416 third-party-advisory
- RHSA-2006:0177 vendor-advisory
- ADV-2007-2280 vdb-entry
- GLSA-200601-02 vendor-advisory
- 18335 third-party-advisory
- 18407 third-party-advisory
- 18332 third-party-advisory
- 18517 third-party-advisory
- 18582 third-party-advisory
- 18534 third-party-advisory
- SSA:2006-045-09 vendor-advisory
- xpdf-ccittfaxdecode-dctdecode-dos(24023) vdb-entry
- 18908 third-party-advisory
- http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html
- 25729 third-party-advisory
- 18414 third-party-advisory
- MDKSA-2006:006 vendor-advisory
- 18338 third-party-advisory
- MDKSA-2006:008 vendor-advisory