PatchTheCVE: libextractorhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2006-2458: Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbihttps://patchthecve.com/cve/CVE-2006-2458.htmlhttps://patchthecve.com/cve/CVE-2006-2458.htmlTue, 16 Jun 2026 22:25:03 +0000MEDIUM 4.0: Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).CVE-2006-1244: Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdhttps://patchthecve.com/cve/CVE-2006-1244.htmlhttps://patchthecve.com/cve/CVE-2006-1244.htmlTue, 16 Jun 2026 22:22:17 +0000HIGH 7.6: Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBCVE-2005-3626: Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allowhttps://patchthecve.com/cve/CVE-2005-3626.htmlhttps://patchthecve.com/cve/CVE-2005-3626.htmlTue, 16 Jun 2026 22:17:17 +0000MEDIUM 5.0: Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.CVE-2005-3625: Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allowhttps://patchthecve.com/cve/CVE-2005-3625.htmlhttps://patchthecve.com/cve/CVE-2005-3625.htmlTue, 16 Jun 2026 22:17:16 +0000HIGH 10.0: Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."CVE-2005-3624: The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPShttps://patchthecve.com/cve/CVE-2005-3624.htmlhttps://patchthecve.com/cve/CVE-2005-3624.htmlTue, 16 Jun 2026 22:17:16 +0000MEDIUM 5.0: The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.