Description
Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libextractor | 0.5.10-1 | — |
| Debian 14 | poppler | 0.4.5-1 | — |
| Debian 14 | xpdf | 3.01-6 | — |
| Debian 13 | libextractor | 0.5.10-1 | — |
| Debian 13 | poppler | 0.4.5-1 | — |
| Debian 13 | xpdf | 3.01-6 | — |
| Debian 12 | libextractor | 0.5.10-1 | — |
| Debian 12 | poppler | 0.4.5-1 | — |
| Debian 12 | xpdf | 3.01-6 | — |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge3 | DSA-982-1, DSA-974-1 |
| Debian 3.1 | koffice | 1.3.5-4.sarge.3 | DSA-1019-1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge3 | DSA-998-1 |
| Debian 3.1 | pdfkit.framework | 0.8-2sarge2 | DSA-979-1, DSA-972-1 |
| Debian 3.1 | pdftohtml | 0.36-11sarge2 | DSA-983-1 |
| Debian 3.1 | xpdf | 3.00-13.5 | DSA-984-1, DSA-971-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kdegraphics +1 | 7:3.3.1-3.7 | RHSA-2006:0206 |
| RHEL 4 | xpdf | 1:3.00-11.12 | RHSA-2006:0201 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 21.08.0-1.3 | openSUSE-SU-2024:11181-1 |
Advisories 12
- RHSA-2006:0206 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0201 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-984-1 xpdf - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-972-1 pdfkit.framework - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-983-1 pdftohtml - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-982-1 gpdf - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-979-1 pdfkit.framework - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-998-1 libextractor - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-971-1 xpdf - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-974-1 gpdf - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1019-1 koffice - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11181-1 libpoppler-cpp0-21.08.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 18707 third-party-advisory
- ADV-2006-0422 vdb-entry
- 1015576 vdb-entry
- 18837 third-party-advisory
- xpdf-splash-bo(24391) vdb-entry
- 18834 third-party-advisory
- MDKSA-2006:031 vendor-advisory
- 18983 third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179046
- MDKSA-2006:030 vendor-advisory
- 20060202 [KDE Security Advisory] kpdf/xpdf heap based buffer overflow mailing-list
- 18864 third-party-advisory
- ADV-2006-0389 vdb-entry
- 18677 third-party-advisory
- GLSA-200602-12 vendor-advisory
- FEDORA-2006-103 vendor-advisory
- RHSA-2006:0201 vendor-advisory
- MDKSA-2006:032 vendor-advisory
- GLSA-200602-05 vendor-advisory
- 18882 third-party-advisory
- 18274 third-party-advisory
- oval:org.mitre.oval:def:10850 vdb-entry signature
- DSA-974 vendor-advisory
- DSA-971 vendor-advisory
- 18825 third-party-advisory
- RHSA-2006:0206 vendor-advisory
- http://www.kde.org/info/security/advisory-20060202-1.txt
- 470 third-party-advisory
- SSA:2006-045-09 vendor-advisory
- 18875 third-party-advisory
- GLSA-200602-04 vendor-advisory
- 18860 third-party-advisory
- 18908 third-party-advisory
- 18839 third-party-advisory
- USN-249-1 vendor-advisory
- 18862 third-party-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=141242
- SSA:2006-045-04 vendor-advisory
- 19377 third-party-advisory
- FLSA:175404 vendor-advisory
- DSA-972 vendor-advisory
- 18913 third-party-advisory
- 18838 third-party-advisory
- 18826 third-party-advisory