Description
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.6.4-1 | — |
| Debian 14 | xpdf | 3.02 | — |
| Debian 13 | poppler | 0.6.4-1 | — |
| Debian 13 | xpdf | 3.02 | — |
| Debian 12 | poppler | 0.6.4-1 | — |
| Debian 12 | xpdf | 3.02 | — |
| Debian 4.0 | poppler | 0.4.5-5.1etch3 | DSA-1606-1 |
| Debian 4.0 | xpdf | 3.01-9.1+etch3 | DSA-1548-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | poppler +2 | 0.5.4-4.4.el5_1 | RHSA-2008:0239 |
| RHEL 4 | gpdf | 2.8.2-7.7.2 | RHSA-2008:0262 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-9.el4_6 | RHSA-2008:0238 |
| RHEL 4 | xpdf | 1:3.00-16.el4 | RHSA-2008:0240 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cups | 2.3.3op2-4.2 | openSUSE-SU-2024:10707-1 |
Advisories 7
- RHSA-2008:0239 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0262 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0240 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0238 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1548-1 xpdf Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1606-1 poppler - execution of arbitrary code Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10707-1 cups-2.3.3op2-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 29869 third-party-advisory
- SUSE-SR:2008:011 vendor-advisory
- MDVSA-2008:173 vendor-advisory
- oval:org.mitre.oval:def:11226 vdb-entry signature
- ADV-2008-1265 vdb-entry
- MDVSA-2008:089 vendor-advisory
- 29884 third-party-advisory
- 30019 third-party-advisory
- 29885 third-party-advisory
- 1019893 vdb-entry
- 28830 vdb-entry
- 29853 third-party-advisory
- 29851 third-party-advisory
- 29816 third-party-advisory
- MDVSA-2008:197 vendor-advisory
- RHSA-2008:0239 vendor-advisory
- DSA-1548 vendor-advisory
- DSA-1606 vendor-advisory
- RHSA-2008:0240 vendor-advisory
- GLSA-200804-18 vendor-advisory
- 29868 third-party-advisory
- ADV-2008-1266 vdb-entry
- RHSA-2008:0262 vendor-advisory
- 31035 third-party-advisory
- xpdf-pdf-code-execution(41884) vdb-entry
- 30033 third-party-advisory
- 29836 third-party-advisory
- 29834 third-party-advisory
- RHSA-2008:0238 vendor-advisory
- FEDORA-2008-3312 vendor-advisory
- USN-603-2 vendor-advisory
- USN-603-1 vendor-advisory
- SUSE-SR:2008:013 vendor-advisory
- 30717 third-party-advisory