Description
Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.10.6-1 | — |
| Debian 14 | xpdf | 3.02-1.4+lenny1 | — |
| Debian 13 | poppler | 0.10.6-1 | — |
| Debian 13 | xpdf | 3.02-1.4+lenny1 | — |
| Debian 12 | poppler | 0.10.6-1 | — |
| Debian 12 | xpdf | 3.02-1.4+lenny1 | — |
| Debian 5.0 | kdegraphics | 4:3.5.9-3+lenny1 | DSA-1793-1 |
| Debian 5.0 | xpdf | 3.02-1.4+lenny1 | DSA-1790-1 |
| Debian 4.0 | kdegraphics | 4:3.5.5-3etch3 | DSA-1793-1 |
| Debian 4.0 | xpdf | 3.01-9.1+etch6 | DSA-1790-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cups +3 | 1:1.3.7-8.el5_3.4 | RHSA-2009:0429 |
| RHEL 5 | kdegraphics +1 | 7:3.5.4-12.el5_3 | RHSA-2009:0431 |
| RHEL 5 | poppler +2 | 0.5.4-4.4.el5_3.9 | RHSA-2009:0480 |
| RHEL 5 | tetex +6 | 3.0-33.8.el5_5.5 | RHSA-2010:0400 |
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.27.el4_7.5 | RHSA-2009:0429 |
| RHEL 4 | gpdf | 2.8.2-7.7.2.el4_7.4 | RHSA-2009:0458 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-13.el4 | RHSA-2009:0431 |
| RHEL 4 | tetex +6 | 2.0.2-22.0.1.EL4.16 | RHSA-2010:0399 |
| RHEL 4 | xpdf | 1:3.00-20.el4 | RHSA-2009:0430 |
| RHEL 3 | xpdf | 1:2.02-14.el3 | RHSA-2009:0430 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | kdegraphics +1 | 7:3.5.4-12.el5_3 | RHSA-2009:0431 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 0.49.0-1.1 | openSUSE-SU-2024:10360-1 |
Advisories 10
- RHSA-2009:0429 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0480 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0431 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0400 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0399 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0458 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0430 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1790-1 xpdf - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1793-1 kdegraphics - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10360-1 libpoppler-cpp0-0.49.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-1793 vendor-advisory
- 34963 third-party-advisory
- DSA-1790 vendor-advisory
- 35037 third-party-advisory
- ADV-2009-1077 vdb-entry
- 35064 third-party-advisory
- ADV-2009-1066 vdb-entry
- 34481 third-party-advisory
- SSA:2009-129-01 vendor-advisory
- RHSA-2009:0431 vendor-advisory
- ADV-2009-1065 vdb-entry
- RHSA-2009:0430 vendor-advisory
- FEDORA-2009-6972 vendor-advisory
- 35618 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=495887
- 35065 third-party-advisory
- RHSA-2009:0480 vendor-advisory
- http://poppler.freedesktop.org/releases.html
- 34568 vdb-entry
- MDVSA-2011:175 vendor-advisory
- VU#196617 third-party-advisory
- ADV-2010-1040 vdb-entry
- SUSE-SA:2009:024 vendor-advisory
- RHSA-2009:0458 vendor-advisory
- FEDORA-2009-6982 vendor-advisory
- 34991 third-party-advisory
- MDVSA-2009:101 vendor-advisory
- MDVSA-2010:087 vendor-advisory
- SUSE-SR:2009:010 vendor-advisory
- 35685 third-party-advisory
- ADV-2009-1076 vdb-entry
- 34756 third-party-advisory
- 34291 third-party-advisory
- 34755 third-party-advisory
- 34852 third-party-advisory
- SUSE-SR:2009:012 vendor-advisory
- FEDORA-2009-6973 vendor-advisory
- 34959 third-party-advisory
- oval:org.mitre.oval:def:11323 vdb-entry signature
- 34746 third-party-advisory
- RHSA-2009:0429 vendor-advisory
- 1022073 vdb-entry