PatchTheCVExpdf vulnerabilities
Recent CVEs affecting xpdf products. 20 tracked.
xpdf has 20 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2009-12-21. Highest priority: CVE-2003-0434 (score 61/100).
- CVE-2009-4035 HIGH 9.3 DOWNGRADE DOWNGRADE The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and p
- CVE-2007-5393 HIGH 9.3 DOWNGRADE Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows rem
- CVE-2007-5392 HIGH 9.3 DOWNGRADE Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to e
- CVE-2007-4352 HIGH 7.6 DOWNGRADE Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used
- CVE-2007-0104 MEDIUM 6.8 DOWNGRADE MITIGATE The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) p
- CVE-2006-1244 HIGH 7.6 DOWNGRADE DOWNGRADE Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pd
- CVE-2006-0746 HIGH 7.5 MITIGATE Certain patches for kpdf do not include all relevant patches from xpdf that were associated with CVE-2005-3627
- CVE-2006-0301 HIGH 7.5 MITIGATE Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphic
- CVE-2005-3628 HIGH 7.5 MITIGATE Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such a
- CVE-2005-3627 HIGH 7.5 MITIGATE Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and
- CVE-2005-3193 MEDIUM 5.1 DOWNGRADE Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream
- CVE-2005-3192 HIGH 7.5 DOWNGRADE Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppl
- CVE-2005-3191 MEDIUM 5.1 DOWNGRADE Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineS
- CVE-2005-2097 LOW 2.1 MITIGATE DOWNGRADE xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a deni
- CVE-2005-0064 HIGH 7.5 DOWNGRADE Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote at
- CVE-2004-1125 HIGH 9.3 DOWNGRADE DOWNGRADE Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such
- CVE-2003-0434 HIGH 7.5 DOWNGRADE DOWNGRADE Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbit
- CVE-2002-1384 HIGH 7.2 DOWNGRADE DOWNGRADE Integer overflow in pdftops, as used in Xpdf 2.01 and earlier, xpdf-i, and CUPS before 1.1.18, allows local us
- CVE-2000-0728 HIGH 7.2 DOWNGRADE xpdf PDF viewer client earlier than 0.91 allows local users to overwrite arbitrary files via a symlink attack.
- CVE-2000-0727 HIGH 7.6 DOWNGRADE xpdf PDF viewer client earlier than 0.91 does not properly launch a web browser for embedded URL's, which allo
FAQ
How do I fix xpdf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xpdf being exploited right now?
None of the tracked xpdf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xpdf CVE should I patch first?
CVE-2003-0434 currently ranks highest (61/100): Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbit.