Description
Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | poppler | 0.12.2-1 | — |
| Debian 14 | xpdf | 3.02-2 | — |
| Debian 13 | poppler | 0.12.2-1 | — |
| Debian 13 | xpdf | 3.02-2 | — |
| Debian 12 | poppler | 0.12.2-1 | — |
| Debian 12 | xpdf | 3.02-2 | — |
| Debian 5.0 | kdegraphics | 4:3.5.9-3+lenny3 | DSA-2050-1 |
| Debian 5.0 | poppler | 0.8.7-3 | DSA-1941-1 |
| Debian 5.0 | xpdf | 3.02-1.4+lenny2 | DSA-2028-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ipe | No fix yet | — |
| Ubuntu 26.04 LTS | ipe | No fix yet | — |
| Ubuntu 25.10 | ipe | No fix yet | — |
| Ubuntu 24.04 LTS | ipe | No fix yet | — |
| Ubuntu 22.04 LTS | ipe | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ipe | No fix yet | — |
| Ubuntu 18.04 LTS | ipe | No fix yet | — |
| Ubuntu 16.04 LTS | ipe | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | cups +3 | 1:1.3.7-11.el5_4.3 | RHSA-2009:1513 |
| RHEL 5 | kdegraphics +1 | 7:3.5.4-15.el5_4.2 | RHSA-2009:1502 |
| RHEL 5 | poppler +2 | 0.5.4-4.4.el5_4.11 | RHSA-2009:1504 |
| RHEL 5 | tetex +6 | 3.0-33.8.el5_5.5 | RHSA-2010:0400 |
| RHEL 4 | gpdf | 2.8.2-7.7.2.el4_8.5 | RHSA-2009:1503 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-15.el4_8.2 | RHSA-2009:1512 |
| RHEL 4 | xpdf | 1:3.00-22.el4_8.1 | RHSA-2009:1501 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | kdegraphics +1 | 7:3.5.4-15.el5_4.2 | RHSA-2009:1502 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | poppler | 0.49.0-1.1 | openSUSE-SU-2024:10360-1 |
Advisories 11
- RHSA-2009:1513 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1502 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1504 Red Hat Security Advisory: poppler security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0400 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1512 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1503 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1501 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2050-1 kdegraphics - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1941-1 poppler - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2028-1 xpdf - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10360-1 libpoppler-cpp0-0.49.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 39938 third-party-advisory
- RHSA-2009:1504 vendor-advisory
- DSA-1941 vendor-advisory
- MDVSA-2009:287 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=526637
- [oss-security] 20091201 Re: Need more information on recent poppler issues mailing-list
- 37028 third-party-advisory
- FEDORA-2010-1377 vendor-advisory
- FEDORA-2009-10823 vendor-advisory
- http://poppler.freedesktop.org/
- RHSA-2009:1501 vendor-advisory
- 37079 third-party-advisory
- SUSE-SR:2009:018 vendor-advisory
- DSA-2028 vendor-advisory
- DSA-2050 vendor-advisory
- [oss-security] 20091130 Need more information on recent poppler issues mailing-list
- 37159 third-party-advisory
- 37054 third-party-advisory
- FEDORA-2010-1805 vendor-advisory
- 1021706 vendor-advisory
- FEDORA-2009-10845 vendor-advisory
- RHSA-2009:1512 vendor-advisory
- 37114 third-party-advisory
- 37077 third-party-advisory
- 1023029 vdb-entry
- RHSA-2009:1503 vendor-advisory
- ADV-2009-2926 vdb-entry
- MDVSA-2011:175 vendor-advisory
- 37037 third-party-advisory
- USN-850-3 vendor-advisory
- ADV-2010-0802 vdb-entry
- RHSA-2009:1502 vendor-advisory
- FEDORA-2010-1842 vendor-advisory
- xpdf-objectstream-bo(53794) vdb-entry
- ADV-2009-2928 vdb-entry
- RHSA-2009:1513 vendor-advisory
- 37034 third-party-advisory
- [oss-security] 20091130 Re: Need more information on recent poppler issues mailing-list
- ADV-2009-2924 vdb-entry
- 37051 third-party-advisory
- 274030 vendor-advisory
- ADV-2010-1220 vdb-entry
- USN-850-1 vendor-advisory
- 37053 third-party-advisory
- 37061 third-party-advisory
- 39327 third-party-advisory
- 37043 third-party-advisory
- http://www.ocert.org/advisories/ocert-2009-016.html
- oval:org.mitre.oval:def:9536 vdb-entry signature
- 36703 vdb-entry
- ADV-2009-2925 vdb-entry
- MDVSA-2009:334 vendor-advisory