PatchTheCVExpdf vulnerabilities and fixes
Recent CVEs affecting xpdf, with upgrade or downgrade steps. 12 tracked.
xpdf has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2024-08-15. Highest priority: CVE-2024-7868 (score 42/100).
- CVE-2024-7868 HIGH 8.2 UPGRADE In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable i
- CVE-2024-7867 MEDIUM 6.2 UPGRADE In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-z
- CVE-2024-7866 MEDIUM 5.5 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack ov
- CVE-2024-4568 LOW 2.9 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack ove
- CVE-2024-4141 LOW 2.9 UPGRADE Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font
- CVE-2024-3900 LOW 2.9 UPGRADE Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText.
- CVE-2024-3248 LOW 2.9 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overf
- CVE-2024-3247 LOW 2.9 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack over
- CVE-2024-2971 LOW 2.9 UPGRADE Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by negative object number in indirect reference
- CVE-2023-3436 LOW 3.3 DOWNGRADE Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
- CVE-2023-3044 LOW 3.3 UPGRADE An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divid
- CVE-2022-48545 MEDIUM 5.5 DOWNGRADE An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
FAQ
How do I fix xpdf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xpdf being exploited right now?
None of the tracked xpdf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xpdf CVE should I patch first?
CVE-2024-7868 currently ranks highest (42/100): In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable i.