| Package | Affected versions | Patched versions |
|---|---|---|
| xpdf | = 3.02pl1= 3.02pl2= 3.02pl3 | |
| xpdfreader | = 3.00= 3.01= 3.02 | |
| poppler | = 0.1= 0.1.1= 0.1.2= 0.10.0= 0.10.1= 0.10.2= 0.10.3= 0.10.4= 0.10.5= 0.10.6= 0.10.7= 0.11.0= 0.11.1= 0.11.2= 0.11.3= 0.2.0= 0.3.0= 0.3.1= 0.3.2= 0.3.3= 0.4.0= 0.4.1= 0.4.2= 0.4.3= 0.4.4= 0.5.0= 0.5.1= 0.5.2= 0.5.3= 0.5.4= 0.5.9= 0.6.0= 0.6.1= 0.6.2= 0.6.3= 0.6.4= 0.7.0= 0.7.1= 0.7.2= 0.7.3= 0.8.0= 0.8.1= 0.8.2= 0.8.3= 0.8.4= 0.8.6= 0.8.7= 0.9.0= 0.9.1= 0.9.2= 0.9.3≤ 0.12.0 |
Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free