Description
The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.4.5-5.1 | — |
| Debian 14 | xpdf | 3.02 | — |
| Debian 13 | poppler | 0.4.5-5.1 | — |
| Debian 13 | xpdf | 3.02 | — |
| Debian 12 | poppler | 0.4.5-5.1 | — |
| Debian 12 | xpdf | 3.02 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cups | 2.3.3op2-4.2 | openSUSE-SU-2024:10707-1 |
| openSUSE Tumbleweed | poppler | 21.08.0-1.3 | openSUSE-SU-2024:11181-1 |
Advisories 2
- openSUSE-SU-2024:11181-1 libpoppler-cpp0-21.08.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10707-1 cups-2.3.3op2-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 23815 third-party-advisory
- MDKSA-2007:022 vendor-advisory
- MDKSA-2007:020 vendor-advisory
- TA07-072A third-party-advisory
- MDKSA-2007:021 vendor-advisory
- http://www.kde.org/info/security/advisory-20070115-1.txt
- MDKSA-2007:019 vendor-advisory
- 23799 third-party-advisory
- 23839 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- multiple-vendor-pdf-code-execution(31364) vdb-entry
- USN-410-2 vendor-advisory
- MDKSA-2007:018 vendor-advisory
- 1017514 vdb-entry
- 23791 third-party-advisory
- SUSE-SR:2007:003 vendor-advisory
- http://support.novell.com/techcenter/psdb/44d7cb9b669d58e0ce5aa5d7ab2c7c53.html
- 21910 vdb-entry
- MDKSA-2007:024 vendor-advisory
- 1017749 vdb-entry
- http://projects.info-pull.com/moab/MOAB-06-01-2007.html
- 23844 third-party-advisory
- USN-410-1 vendor-advisory
- ADV-2007-0203 vdb-entry
- 23876 third-party-advisory
- 20070116 [KDE Security Advisory] kpdf/kword/xpdf denial of service vulnerability mailing-list
- ADV-2007-0244 vdb-entry
- ADV-2007-0212 vdb-entry
- ADV-2007-0930 vdb-entry
- https://issues.rpath.com/browse/RPL-964
- 23813 third-party-advisory
- 24204 third-party-advisory
- 23808 third-party-advisory
- 24479 third-party-advisory