Description
Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.22-7 | — |
| Debian 14 | libextractor | 0.5.9-1 | — |
| Debian 14 | poppler | 0.4.4-1 | — |
| Debian 14 | xpdf | 3.01-4 | — |
| Debian 13 | cups | 1.1.22-7 | — |
| Debian 13 | libextractor | 0.5.9-1 | — |
| Debian 13 | poppler | 0.4.4-1 | — |
| Debian 13 | xpdf | 3.01-4 | — |
| Debian 12 | cups | 1.1.22-7 | — |
| Debian 12 | libextractor | 0.5.9-1 | — |
| Debian 12 | poppler | 0.4.4-1 | — |
| Debian 12 | xpdf | 3.01-4 | — |
| Debian 4.0 | gpdf | 2.10.0-1+etch1 | DTSA-28-1 |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge2 | DSA-940-1 |
| Debian 3.1 | kdegraphics | 4:3.3.2-2sarge3 | DSA-932-1 |
| Debian 3.1 | koffice | 1:1.3.5-4.sarge.2 | DSA-938-1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge2 | DSA-936-1 |
| Debian 3.1 | pdfkit.framework | 0.8-2sarge1 | DSA-961-1 |
| Debian 3.1 | pdftohtml | 0.36-11sarge1 | DSA-962-1 |
| Debian 3.1 | tetex-bin | 2.0.2-30sarge4 | DSA-937-1 |
| Debian 3.1 | xpdf | 3.00-13.4 | DSA-931-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.10 | RHSA-2006:0163 |
| RHEL 4 | gpdf | 2.8.2-7.4 | RHSA-2006:0177 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-3.6 | RHSA-2005:868 |
| RHEL 4 | tetex +6 | 2.0.2-22.EL4.7 | RHSA-2006:0160 |
| RHEL 4 | xpdf | 1:3.00-11.10 | RHSA-2005:840 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.36 | RHSA-2006:0163 |
| RHEL 3 | tetex +5 | 1.0.7-67.9 | RHSA-2006:0160 |
| RHEL 3 | xpdf | 1:2.02-9.8 | RHSA-2005:840 |
Advisories 15
- RHSA-2006:0177 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0163 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0160 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:868 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2005:840 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-936-1 libextractor - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-962-1 pdftohtml - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-932-1 kdegraphics - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-938-1 koffice - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-940-1 gpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-950-1 cupsys - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-937-1 tetex-bin - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-931-1 xpdf - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-961-1 pdfkit.framework - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-28-1 gpdf - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 16143 vdb-entry
- DSA-932 vendor-advisory
- 18349 third-party-advisory
- 18147 third-party-advisory
- http://scary.beasts.org/security/CESA-2005-003.txt
- http://www.kde.org/info/security/advisory-20051207-2.txt
- 18679 third-party-advisory
- 18312 third-party-advisory
- 18644 third-party-advisory
- USN-236-1 vendor-advisory
- 18425 third-party-advisory
- 18373 third-party-advisory
- 18303 third-party-advisory
- DSA-931 vendor-advisory
- 18554 third-party-advisory
- MDKSA-2006:003 vendor-advisory
- 19230 third-party-advisory
- 102972 vendor-advisory
- MDKSA-2006:012 vendor-advisory
- DSA-962 vendor-advisory
- http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html
- RHSA-2006:0163 vendor-advisory
- DSA-937 vendor-advisory
- 18398 third-party-advisory
- FLSA-2006:176751 vendor-advisory
- 2006-0002 vendor-advisory
- SUSE-SA:2006:001 vendor-advisory
- DSA-936 vendor-advisory
- FEDORA-2005-026 vendor-advisory
- 18329 third-party-advisory
- 18463 third-party-advisory
- 18642 third-party-advisory
- 18674 third-party-advisory
- MDKSA-2006:005 vendor-advisory
- 18313 third-party-advisory
- 18448 third-party-advisory
- 18436 third-party-advisory
- 18428 third-party-advisory
- 18380 third-party-advisory
- 18423 third-party-advisory
- 18416 third-party-advisory
- RHSA-2006:0177 vendor-advisory
- ADV-2007-2280 vdb-entry
- GLSA-200601-02 vendor-advisory
- 18335 third-party-advisory
- xpdf-readscaninfo-bo(24025) vdb-entry
- 18407 third-party-advisory
- 18332 third-party-advisory
- 18517 third-party-advisory
- 18582 third-party-advisory
- 18534 third-party-advisory
- SSA:2006-045-09 vendor-advisory
- 18908 third-party-advisory
- http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html
- 25729 third-party-advisory
- 18414 third-party-advisory
- xpdf-readhuffmantables-bo(24024) vdb-entry
- MDKSA-2006:006 vendor-advisory
- 18338 third-party-advisory
- MDKSA-2006:008 vendor-advisory