Description
Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.1.22-7 | — |
| Debian 14 | libextractor | 0.5.12-1 | — |
| Debian 14 | poppler | 0.6.2-1 | — |
| Debian 14 | xpdf | 3.02-1.3 | — |
| Debian 13 | cups | 1.1.22-7 | — |
| Debian 13 | libextractor | 0.5.12-1 | — |
| Debian 13 | poppler | 0.6.2-1 | — |
| Debian 13 | xpdf | 3.02-1.3 | — |
| Debian 12 | cups | 1.1.22-7 | — |
| Debian 12 | libextractor | 0.5.12-1 | — |
| Debian 12 | poppler | 0.6.2-1 | — |
| Debian 12 | xpdf | 3.02-1.3 | — |
| Debian 5.0 | kdegraphics | 4:3.5.7-4+lenny1 | DTSA-85-1 |
| Debian 5.0 | koffice | 1:1.6.3-3+lenny1 | DTSA-86-1 |
| Debian 4.0 | koffice | 1:1.6.1-2etch2 | DSA-1509-1 |
| Debian 4.0 | poppler | 0.4.5-5.1etch2 | DSA-1480-1 |
| Debian 4.0 | xpdf | 3.01-9.1+etch2 | DSA-1537-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cups +3 | 1:1.2.4-11.14.el5_1.3 | RHSA-2007:1021 |
| RHEL 5 | poppler +2 | 0.5.4-4.3.el5_1 | RHSA-2007:1026 |
| RHEL 5 | tetex +6 | 3.0-33.2.el5_1.2 | RHSA-2007:1027 |
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.20.2.el4_5.2 | RHSA-2007:1022 |
| RHEL 4 | gpdf | 2.8.2-7.7.1 | RHSA-2007:1025 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-6.el4_5 | RHSA-2007:1024 |
| RHEL 4 | tetex +6 | 2.0.2-22.0.1.EL4.10 | RHSA-2007:1027 |
| RHEL 4 | xpdf | 1:3.00-14.el4 | RHSA-2007:1029 |
| RHEL 3 | xpdf | 1:2.02-11.el3 | RHSA-2007:1030 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 21.08.0-1.3 | openSUSE-SU-2024:11181-1 |
Advisories 14
- RHSA-2007:1021 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1026 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1030 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1029 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1027 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1024 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1025 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:1022 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1509-1 koffice - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1537-1 xpdf Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-85-1 kdegraphics - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1480-1 poppler - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-86-1 koffice - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11181-1 libpoppler-cpp0-21.08.0-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SUSE-SA:2007:060 vendor-advisory
- 27632 third-party-advisory
- 27743 third-party-advisory
- MDKSA-2007:222 vendor-advisory
- ADV-2007-3774 vdb-entry
- 27260 third-party-advisory
- 27856 third-party-advisory
- http://support.novell.com/techcenter/psdb/da3498f05433976cc548cc4eaf8349c8.html
- 27636 third-party-advisory
- 29604 third-party-advisory
- MDKSA-2007:223 vendor-advisory
- 27721 third-party-advisory
- 27724 third-party-advisory
- ADV-2007-3776 vdb-entry
- FEDORA-2007-3059 vendor-advisory
- 27577 third-party-advisory
- 29104 third-party-advisory
- FEDORA-2007-3031 vendor-advisory
- 27618 third-party-advisory
- 27642 third-party-advisory
- FEDORA-2007-4031 vendor-advisory
- 27656 third-party-advisory
- http://secunia.com/secunia_research/2007-88/advisory/
- FEDORA-2007-3100 vendor-advisory
- http://support.novell.com/techcenter/psdb/1d5fd29802b2ef7e342e733731f1e933.html
- RHSA-2007:1026 vendor-advisory
- DSA-1509 vendor-advisory
- RHSA-2007:1022 vendor-advisory
- 27573 third-party-advisory
- RHSA-2007:1029 vendor-advisory
- 27641 third-party-advisory
- GLSA-200805-13 vendor-advisory
- 28812 third-party-advisory
- DSA-1537 vendor-advisory
- FEDORA-2007-750 vendor-advisory
- SSA:2007-316-01 vendor-advisory
- 26367 vdb-entry
- 27615 third-party-advisory
- RHSA-2007:1021 vendor-advisory
- ADV-2007-3786 vdb-entry
- 27645 third-party-advisory
- 20071107 Secunia Research: Xpdf "Stream.cc" Multiple Vulnerabilities mailing-list
- 30168 third-party-advisory
- 27574 third-party-advisory
- https://issues.rpath.com/browse/RPL-1926
- 26503 third-party-advisory
- MDKSA-2007:219 vendor-advisory
- DSA-1480 vendor-advisory
- GLSA-200711-22 vendor-advisory
- 27634 third-party-advisory
- MDKSA-2007:227 vendor-advisory
- http://www.kde.org/info/security/advisory-20071107-1.txt
- 28043 third-party-advisory
- oval:org.mitre.oval:def:10036 vdb-entry signature
- 27619 third-party-advisory
- xpdf-dctstreamreset-bo(38303) vdb-entry
- MDKSA-2007:220 vendor-advisory
- 27705 third-party-advisory
- 27578 third-party-advisory
- 27640 third-party-advisory