| Package | Affected versions | Patched versions |
|---|---|---|
| xpdf | = 0.5a= 0.7a= 0.91a= 0.91b= 0.91c= 0.92a= 0.92b= 0.92c= 0.92d= 0.92e= 0.93a= 0.93b= 0.93c= 1.00a= 3.0.1= 3.02pl1= 3.02pl2= 3.02pl3 | |
| xpdfreader | = 0.2= 0.3= 0.4= 0.5= 0.6= 0.7= 0.80= 0.90= 0.91= 0.92= 0.93= 1.00= 1.01= 2.00= 2.01= 2.02= 2.03= 3.00= 3.01= 3.02≤ 3.02 | |
| poppler | = 0.10.0= 0.10.1= 0.10.2= 0.10.3= 0.10.4= 0.10.5= 0.10.6= 0.10.7= 0.11.0= 0.11.1= 0.11.2= 0.11.3= 0.12.0= 0.12.1= 0.12.2= 0.12.3= 0.12.4= 0.13.0= 0.13.1= 0.13.2= 0.13.3= 0.13.4= 0.14.0= 0.14.1= 0.14.2= 0.14.3= 0.14.4= 0.14.5= 0.15.0= 0.15.1= 0.8.7= 0.9.0= 0.9.1= 0.9.2= 0.9.3 |
The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free