PatchTheCVExpdfreader vulnerabilities
Recent CVEs affecting xpdfreader products. 9 tracked.
xpdfreader has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 9. Most recent: 2024-08-15. Highest priority: CVE-2024-7868 (score 42/100).
- CVE-2024-7868 HIGH 8.2 UPGRADE In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable i
- CVE-2024-7867 MEDIUM 6.2 UPGRADE In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-z
- CVE-2024-7866 MEDIUM 5.5 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in a pattern resource leads to infinite recursion and a stack ov
- CVE-2024-4568 LOW 2.9 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack ove
- CVE-2024-4141 LOW 2.9 UPGRADE Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid character code in a Type 1 font
- CVE-2024-3900 LOW 2.9 UPGRADE Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by long Unicode sequence in ActualText.
- CVE-2024-3248 LOW 2.9 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in the attachments leads to infinite recursion and a stack overf
- CVE-2024-3247 LOW 2.9 UPGRADE In Xpdf 4.05 (and earlier), a PDF object loop in an object stream leads to infinite recursion and a stack over
- CVE-2024-2971 LOW 2.9 UPGRADE Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by negative object number in indirect reference
FAQ
How do I fix xpdfreader vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xpdfreader being exploited right now?
None of the tracked xpdfreader CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xpdfreader CVE should I patch first?
CVE-2024-7868 currently ranks highest (42/100): In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable i.