| Package | Affected versions | Patched versions |
|---|---|---|
| gpdf | = 2.8.2 | |
| libextractor | = 0.3.11= 0.3.6= 0.3.7= 0.3.8= 0.3.9= 0.4= 0.4.1= 0.4.2= 0.5 | |
| xpdf | = 0.90= 0.91= 0.92= 0.93= 1.0= 1.0a= 1.1= 2.0= 2.1= 2.2= 2.3= 3.0= 3.0.1= 3.0.1_pl1= 3.0_pl2= 3.0_pl3 |
Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free