Description
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.12.2-1 | — |
| Debian 14 | xpdf | 3.02-2 | — |
| Debian 13 | poppler | 0.12.2-1 | — |
| Debian 13 | xpdf | 3.02-2 | — |
| Debian 12 | poppler | 0.12.2-1 | — |
| Debian 12 | xpdf | 3.02-2 | — |
| Debian 5.0 | kdegraphics | 4:3.5.9-3+lenny3 | DSA-2050-1 |
| Debian 5.0 | poppler | 0.8.7-3 | DSA-1941-1 |
| Debian 5.0 | xpdf | 3.02-1.4+lenny2 | DSA-2028-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ipe | No fix yet | — |
| Ubuntu 26.04 LTS | ipe | No fix yet | — |
| Ubuntu 25.10 | ipe | No fix yet | — |
| Ubuntu 24.04 LTS | ipe | No fix yet | — |
| Ubuntu 22.04 LTS | ipe | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ipe | No fix yet | — |
| Ubuntu 18.04 LTS | ipe | No fix yet | — |
| Ubuntu 16.04 LTS | ipe | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdegraphics +1 | 7:3.5.4-15.el5_4.2 | RHSA-2009:1502 |
| RHEL 5 | poppler +2 | 0.5.4-4.4.el5_3.9 | RHSA-2009:0480 |
| RHEL 4 | gpdf | 2.8.2-7.7.2.el4_8.5 | RHSA-2009:1503 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-15.el4_8.2 | RHSA-2009:1512 |
| RHEL 4 | xpdf | 1:3.00-22.el4_8.1 | RHSA-2009:1501 |
| RHEL 3 | xpdf | 1:2.02-17.el3 | RHSA-2009:1500 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | kdegraphics +1 | 7:3.5.4-15.el5_4.2 | RHSA-2009:1502 |
Advisories 9
- RHSA-2009:1502 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0480 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1512 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1503 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1501 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1500 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2050-1 kdegraphics - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1941-1 poppler - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2028-1 xpdf - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 39938 third-party-advisory
- 37042 third-party-advisory
- MDVSA-2009:287 vendor-advisory
- 37028 third-party-advisory
- FEDORA-2010-1377 vendor-advisory
- http://site.pi3.com.pl/adv/xpdf.txt
- FEDORA-2009-10823 vendor-advisory
- RHSA-2009:1501 vendor-advisory
- 37079 third-party-advisory
- SUSE-SR:2009:018 vendor-advisory
- xpdf-splashdrawimage-bo(53795) vdb-entry
- DSA-2028 vendor-advisory
- DSA-2050 vendor-advisory
- 37159 third-party-advisory
- FEDORA-2010-1805 vendor-advisory
- 1021706 vendor-advisory
- FEDORA-2009-10845 vendor-advisory
- RHSA-2009:1512 vendor-advisory
- 37114 third-party-advisory
- 37077 third-party-advisory
- 1023029 vdb-entry
- RHSA-2009:1503 vendor-advisory
- http://cgit.freedesktop.org/poppler/poppler/diff/?id=284a928996&id2=75c3466ba2
- MDVSA-2011:175 vendor-advisory
- oval:org.mitre.oval:def:10969 vdb-entry signature
- 37037 third-party-advisory
- ADV-2010-1040 vdb-entry
- USN-850-3 vendor-advisory
- ADV-2010-0802 vdb-entry
- RHSA-2009:1502 vendor-advisory
- FEDORA-2010-1842 vendor-advisory
- http://cgit.freedesktop.org/poppler/poppler/commit/?id=9cf2325fb2
- RHSA-2009:1500 vendor-advisory
- ADV-2009-2928 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=526911
- 37023 third-party-advisory
- ADV-2009-2924 vdb-entry
- MDVSA-2010:087 vendor-advisory
- 274030 vendor-advisory
- ADV-2010-1220 vdb-entry
- USN-850-1 vendor-advisory
- 37053 third-party-advisory
- 39327 third-party-advisory
- 37043 third-party-advisory
- 36703 vdb-entry