| Package | Affected versions | Patched versions |
|---|---|---|
| xpdf | = 0.5a= 0.7a= 0.91a= 0.91b= 0.91c= 0.92a= 0.92b= 0.92c= 0.92d= 0.92e= 0.93a= 0.93b= 0.93c= 1.00a= 3.0.1= 3.02pl1= 3.02pl2= 3.02pl3= 3.02pl4 | |
| xpdfreader | = 0.2= 0.3= 0.4= 0.5= 0.6= 0.7= 0.80= 0.90= 0.91= 0.92= 0.93= 1.00= 1.01= 2.00= 2.01= 2.02= 2.03= 3.00= 3.01= 3.02≤ 3.02 | |
| t1lib | = 0.1= 0.2= 0.3= 0.4= 0.5= 0.6= 0.7= 0.8= 0.9= 0.9.1= 0.9.2= 1.0= 1.0.1= 1.1.0= 1.1.1= 1.2= 1.3= 1.3.1= 5.0.0= 5.0.1= 5.0.2= 5.1.0= 5.1.1≤ 5.1.2 |
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free