Description
In Xpdf 4.01.01, a heap-based buffer over-read could be triggered in strncpy from FoFiType1::parse in fofi/FoFiType1.cc because it does not ensure the source string has a valid length before making a fixed-length copy. It can, for example, be triggered by sending a crafted PDF document to the pdftotext tool. It allows an attacker to use a crafted pdf file to cause Denial of Service or an information leak, or possibly have unspecified other impact.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | poppler | 0.62.0-2ubuntu2.11 | USN-4646-1 |
| Ubuntu 16.04 LTS | poppler | 0.41.0-0ubuntu1.15 | USN-4646-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | poppler | 0.62.0-150000.4.9.1 | SUSE-SU-2023:0480-1 |
| SLES 12 SP5 | poppler | 0.24.4-14.23.1 | SUSE-SU-2023:0496-1, SUSE-SU-2023:0494-1 |
| SLES 12 SP5 | poppler-qt | 0.43.0-16.22.1 | SUSE-SU-2023:0494-1 |
| SLES 12 SP4 | poppler +1 | 0.43.0-16.22.1 | SUSE-SU-2023:0494-1 |
| SLES 12 SP2 | poppler +1 | 0.43.0-16.22.1 | SUSE-SU-2023:0494-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | poppler | 0.62.0-150000.4.9.1 | SUSE-SU-2023:0480-1 |
| SLES for SAP 12 SP5 | poppler +1 | 0.43.0-16.22.1 | SUSE-SU-2023:0494-1 |
| SLES for SAP 12 SP4 | poppler +1 | 0.43.0-16.22.1 | SUSE-SU-2023:0494-1 |
| SLE HPC 15 SP1 | poppler | 0.62.0-150000.4.9.1 | SUSE-SU-2023:0480-1 |
| SUSE OpenStack Cloud Crowbar 9 | poppler +1 | 0.43.0-16.22.1 | SUSE-SU-2023:0494-1 |
| SUSE OpenStack Cloud 9 | poppler +1 | 0.43.0-16.22.1 | SUSE-SU-2023:0494-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | poppler | 0.62.0-150000.4.9.1 | SUSE-SU-2023:0480-1 |
Advisories 5
- USN-4646-1 poppler vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- SUSE-SU-2023:0480-1 Security update for poppler SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0496-1 Security update for poppler SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0494-1 Security update for poppler SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0473 xpdf: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2023
References
- https://forum.xpdfreader.com/viewtopic.php?f=3&t=41843
- FEDORA-2019-a457286734 vendor-advisory
- FEDORA-2019-01da705767 vendor-advisory
- FEDORA-2019-759ba8202b vendor-advisory