Description
Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libextractor | 0.5.12-1 | — |
| Debian 14 | poppler | 0.5.4-6.1 | — |
| Debian 14 | xpdf | 3.02-1.1 | — |
| Debian 13 | libextractor | 0.5.12-1 | — |
| Debian 13 | poppler | 0.5.4-6.1 | — |
| Debian 13 | xpdf | 3.02-1.1 | — |
| Debian 12 | libextractor | 0.5.12-1 | — |
| Debian 12 | poppler | 0.5.4-6.1 | — |
| Debian 12 | xpdf | 3.02-1.1 | — |
| Debian 5.0 | kdegraphics | 4:3.5.7-2lenny1 | DTSA-49-1 |
| Debian 5.0 | koffice | 1:1.6.3-1lenny1 | DTSA-50-1 |
| Debian 5.0 | poppler | 0.5.4-6lenny1 | DTSA-62-1, DTSA-54-1 |
| Debian 4.0 | kdegraphics | 4:3.5.5-3etch1 | DSA-1355-1 |
| Debian 4.0 | koffice | 1:1.6.1-2etch1 | DSA-1357-1 |
| Debian 4.0 | poppler | 0.4.5-5.1etch1 | DSA-1348-1 |
| Debian 4.0 | xpdf | 3.01-9etch1 | DSA-1347-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | gpdf | 2.8.2-1.2sarge6 | DSA-1354-1 |
| Debian 3.1 | kdegraphics | 4:3.3.2-2sarge5 | DSA-1355-1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge6 | DSA-1349-1 |
| Debian 3.1 | pdfkit.framework | 0.8-2sarge4 | DSA-1352-1 |
| Debian 3.1 | tetex-bin | 2.0.2-30sarge5 | DSA-1350-1 |
| Debian 3.1 | xpdf | 3.00-13.7 | DSA-1347-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cups +3 | 1:1.2.4-11.5.3.el5 | RHSA-2007:0720 |
| RHEL 5 | kdegraphics +1 | 7:3.5.4-2.el5 | RHSA-2007:0729 |
| RHEL 5 | poppler +2 | 0.5.4-4.1.el5 | RHSA-2007:0732 |
| RHEL 5 | tetex +6 | 3.0-33.1.el5 | RHSA-2007:0731 |
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.20.2 | RHSA-2007:0720 |
| RHEL 4 | gpdf | 2.8.2-7.7 | RHSA-2007:0730 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-4.RHEL4 | RHSA-2007:0729 |
| RHEL 4 | tetex +6 | 2.0.2-22.0.1.EL4.8 | RHSA-2007:0731 |
| RHEL 4 | xpdf | 1:3.00-12.RHEL4 | RHSA-2007:0735 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.45 | RHSA-2007:0720 |
| RHEL 3 | tetex +5 | 1.0.7-67.10 | RHSA-2007:0731 |
| RHEL 3 | xpdf | 1:2.02-10.RHEL3 | RHSA-2007:0735 |
| RHEL 2 | tetex +7 | 1.0.7-38.5E.11 | RHSA-2007:0731 |
| RHEL 2 | xpdf | 1:0.92-18.RHEL2 | RHSA-2007:0735 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | kdegraphics +1 | 7:3.5.4-2.el5 | RHSA-2007:0729 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cups | 2.3.3op2-4.2 | openSUSE-SU-2024:10707-1 |
Advisories 19
- RHSA-2007:0720 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0729 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0732 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0735 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0731 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0730 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1349-1 libextractor - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1354-1 gpdf - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-49-1 kdegraphics - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1357-1 koffice - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1348-1 poppler Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1355-1 kdegraphics - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1347-1 xpdf Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-54-1 poppler - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1350-1 tetex-bin Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-62-1 poppler - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1352-1 pdfkit.framework - integer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-50-1 koffice - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10707-1 cups-2.3.3op2-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2007:0730 vendor-advisory
- USN-496-1 vendor-advisory
- DSA-1355 vendor-advisory
- ADV-2007-2705 vdb-entry
- SUSE-SR:2007:016 vendor-advisory
- MDKSA-2007:164 vendor-advisory
- https://issues.rpath.com/browse/RPL-1596
- MDKSA-2007:165 vendor-advisory
- 26307 third-party-advisory
- MDKSA-2007:158 vendor-advisory
- DSA-1350 vendor-advisory
- 20070814 FLEA-2007-0045-1 poppler mailing-list
- 26468 third-party-advisory
- 20070814 FLEA-2007-0044-1 tetex tetex-dvips tetex-fonts mailing-list
- 26982 third-party-advisory
- 26254 third-party-advisory
- 26370 third-party-advisory
- DSA-1348 vendor-advisory
- 26325 third-party-advisory
- 26413 third-party-advisory
- DSA-1352 vendor-advisory
- GLSA-200710-08 vendor-advisory
- DSA-1354 vendor-advisory
- https://issues.rpath.com/browse/RPL-1604
- http://sourceforge.net/project/shownotes.php?release_id=535497
- USN-496-2 vendor-advisory
- MDKSA-2007:163 vendor-advisory
- http://www.kde.org/info/security/advisory-20070730-1.txt
- RHSA-2007:0731 vendor-advisory
- 40127 vdb-entry
- 26862 third-party-advisory
- GLSA-200805-13 vendor-advisory
- 26281 third-party-advisory
- RHSA-2007:0720 vendor-advisory
- GLSA-200709-12 vendor-advisory
- 25124 vdb-entry
- 26514 third-party-advisory
- 26467 third-party-advisory
- SSA:2007-316-01 vendor-advisory
- 26432 third-party-advisory
- 26410 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=187139
- 26607 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-401.htm
- 30168 third-party-advisory
- 26358 third-party-advisory
- 26365 third-party-advisory
- 26627 third-party-advisory
- 26293 third-party-advisory
- 26283 third-party-advisory
- MDKSA-2007:159 vendor-advisory
- 27308 third-party-advisory
- MDKSA-2007:160 vendor-advisory
- DSA-1357 vendor-advisory
- GLSA-200709-17 vendor-advisory
- 26403 third-party-advisory
- RHSA-2007:0732 vendor-advisory
- DSA-1349 vendor-advisory
- 26251 third-party-advisory
- oval:org.mitre.oval:def:11149 vdb-entry signature