Description
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | t1lib | 5.1.0-2etch1 | DSA-1390-1 |
| Debian 3.1 | t1lib | 5.0.2-3sarge1 | DSA-1390-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tetex +6 | 3.0-33.2.el5_1.2 | RHSA-2007:1027 |
| RHEL 4 | tetex +6 | 2.0.2-22.0.1.EL4.10 | RHSA-2007:1027 |
| RHEL 3 | xpdf | 1:2.02-11.el3 | RHSA-2007:1030 |
| RHEL 2 | xpdf | 1:0.92-19.el2 | RHSA-2007:1031 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- PHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC) EDB-4227 · dos · Jul 26, 2007 · verified
- T1lib - 'intT1_Env_GetCompletePath' Buffer Overflow (PoC) EDB-30401 · dos · Jul 26, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2007:1031 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1030 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1027 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1390-1 t1lib - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- GLSA-200710-12 vendor-advisory
- 27743 third-party-advisory
- 26901 third-party-advisory
- oval:org.mitre.oval:def:10557 vdb-entry signature
- php-imagepsloadfont-bo(35620) vdb-entry
- FEDORA-2007-2343 vendor-advisory
- 20070921 Re: [Full-disclosure] [USN-515-1] t1lib vulnerability mailing-list
- DSA-1390 vendor-advisory
- 27297 third-party-advisory
- GLSA-200805-13 vendor-advisory
- 20080105 rPSA-2008-0007-1 tetex tetex-afm tetex-dvips tetex-fonts tetex-latex tetex-xdvi mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0007
- https://bugzilla.redhat.com/show_bug.cgi?id=303021
- FEDORA-2007-750 vendor-advisory
- RHSA-2007:1031 vendor-advisory
- MDKSA-2007:189 vendor-advisory
- 4227 exploit
- 30168 third-party-advisory
- https://issues.rpath.com/browse/RPL-1972
- 27239 third-party-advisory
- 26241 third-party-advisory
- 20070921 Re: [USN-515-1] t1lib vulnerability mailing-list
- 25079 vdb-entry
- 27718 third-party-advisory
- http://www.bugtraq.ir/adv/t1lib.txt
- GLSA-200711-34 vendor-advisory
- 28345 third-party-advisory
- 27599 third-party-advisory
- USN-515-1 vendor-advisory
- 27439 third-party-advisory
- 1018905 vdb-entry
- FEDORA-2007-3390 vendor-advisory
- 26981 third-party-advisory
- RHSA-2007:1027 vendor-advisory
- RHSA-2007:1030 vendor-advisory
- MDKSA-2007:230 vendor-advisory
- 26992 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=193437
- SUSE-SR:2007:023 vendor-advisory
- 20080212 FLEA-2008-0006-1 tetex tetex-dvips tetex-fonts mailing-list