Multiple vulnerabilities have been discovered in Poppler, the worst of which could lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 25.06.0 | >= 25.06.0 |
Poppler is a PDF rendering library based on the xpdf-3.0 code base.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-25.06.0"
A vulnerability has been discovered in Poppler which could allow for arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 22.09.0 | >= 22.09.0 |
Poppler is a PDF rendering library based on the xpdf-3.0 code base.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code.
Avoid opening untrusted PDFs.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-22.09.0"
Multiple vulnerabilities have been found in Poppler, the worst of which could allow a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.70.0 | >= 0.70.0 |
Poppler is a PDF rendering library based on the xpdf-3.0 code base.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.70.0"
Multiple vulnerabilities have been found in Poppler, the worst of which could allow a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.61.1 | >= 0.61.1 |
Poppler is a PDF rendering library based on the xpdf-3.0 code base.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
A remote attacker, by enticing a user to open a specially crafted PDF, could cause a Denial of Service condition or have other unspecified impacts.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.61.1"
Multiple vulnerabilities have been found in Poppler, the worst of which could allow the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.57.0-r1 | >= 0.57.0-r1 |
Poppler is a PDF rendering library based on the xpdf-3.0 code base.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
A remote attacker, by enticing a user to open a specially crafted PDF, could execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.57.0-r1"
Multiple vulnerabilities have been found in Poppler, the worst of which allows remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.42.0 | >= 0.42.0 |
Poppler is a PDF rendering library based on the xpdf-3.0 code base.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted PDF using Poppler, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.42.0"
Multiple vulnerabilities have been found in Poppler, allowing remote attackers to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.24.5 | >= 0.24.5 |
Poppler is a cross-platform PDF rendering library originally based on Xpdf.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted PDF in an application linked against Poppler, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.24.5"
Multiple vulnerabilities have been found in Poppler, some of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.22.2-r1 | >= 0.22.2-r1 |
Poppler is a cross-platform PDF rendering library originally based on Xpdf.
Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to open a specially crafted PDF file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.22.2-r1"
Poppler is affected by a memory management issue, which could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.6.3-r1 | >= 0.6.3-r1 |
Poppler is a cross-platform PDF rendering library originally based on Xpdf.
Felipe Andres Manzano reported a memory management issue in the Page class constructor/destructor.
A remote attacker could entice a user to open a specially crafted PDF file with a Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview, or Evince, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.6.3-r1"
Poppler does not handle fonts inside PDF files safely, allowing for execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.6.3 | >= 0.6.3 |
Poppler is a cross-platform PDF rendering library originally based on Xpdf.
Kees Cook from the Ubuntu Security Team reported that the CairoFont::create() function in the file CairoFontEngine.cc does not verify the type of an embedded font object inside a PDF file before dereferencing a function pointer from it.
A remote attacker could entice a user to open a specially crafted PDF file with a Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview, or Evince, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.6.3"
Poppler and various KDE components are vulnerable to multiple memory management issues possibly resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-office/koffice | * | < 1.6.3-r2 | >= 1.6.3-r2 |
| app-office/kword | * | < 1.6.3-r2 | >= 1.6.3-r2 |
| app-text/poppler | * | < 0.6.1-r1 | >= 0.6.1-r1 |
| kde-base/kdegraphics | * | < 3.5.8-r1 | >= 3.5.7-r3 (revision), >= 3.5.8-r1 |
| kde-base/kpdf | * | < 3.5.8-r1 | >= 3.5.7-r3 (revision), >= 3.5.8-r1 |
Poppler is a cross-platform PDF rendering library originally based on Xpdf. KOffice is an integrated office suite for KDE. KWord is the KOffice word processor. KPDF is a KDE-based PDF viewer included in the kdegraphics package.
Alin Rad Pop (Secunia Research) discovered several vulnerabilities in the "Stream.cc" file of Xpdf: An integer overflow in the DCTStream::reset() method and a boundary error in the CCITTFaxStream::lookChar() method, both leading to heap-based buffer overflows (CVE-2007-5392, CVE-2007-5393). He also discovered a boundary checking error in the DCTStream::readProgressiveDataUnit() method causing memory corruption (CVE-2007-4352). Note: Gentoo's version of Xpdf is patched to use the Poppler library, so the update to Poppler will also fix Xpdf.
By enticing a user to view or process a specially crafted PDF file with KWord or KPDF or a Poppler-based program such as Gentoo's viewers Xpdf, ePDFView, and Evince or the CUPS printing system, a remote attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.6.1-r1"
All KPDF users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-base/kpdf-3.5.7-r3"
All KDE Graphics Libraries users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.5.7-r3"
All KWord users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-office/kword-1.6.3-r2"
All KOffice users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-office/koffice-1.6.3-r2"
Poppler is vulnerable to an integer overflow and a stack overflow.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.5.4-r2 | >= 0.5.4-r2 |
Poppler is a cross-platform PDF rendering library originally based on Xpdf.
Poppler and Xpdf are vulnerable to an integer overflow in the StreamPredictor::StreamPredictor function, and a stack overflow in the StreamPredictor::getNextLine function. The original vulnerability was discovered by Maurycy Prodeus. Note: Gentoo's version of Xpdf is patched to use the Poppler library, so the update to Poppler will also fix Xpdf.
By enticing a user to view a specially crafted program with a Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview, or Evince, a remote attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Poppler users should upgrade to the latest version of Poppler:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.5.4-r2"
Xpdf and Poppler are vulnerable to a heap overflow that may be exploited to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.5.0-r4 | >= 0.5.0-r4 |
| app-text/xpdf | * | < 3.01-r7 | >= 3.01-r7 |
Xpdf is a PDF file viewer that runs under the X Window System. Poppler is a PDF rendering library based on the Xpdf 3.0 code base.
Dirk Mueller has reported a vulnerability in Xpdf. It is caused by a missing boundary check in the splash rasterizer engine when handling PDF splash images with overly large dimensions.
By sending a specially crafted PDF file to a victim, an attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.01-r7"
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.5.0-r4"
Xpdf, Poppler, GPdf, libextractor and pdftohtml are vulnerable to integer overflows that may be exploited to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/gpdf | * | < 2.10.0-r3 | >= 2.10.0-r3 |
| app-text/pdftohtml | * | < 0.36-r4 | — |
| app-text/poppler | * | < 0.4.3-r4 | >= 0.4.3-r4 |
| app-text/xpdf | * | < 3.01-r5 | >= 3.01-r5 |
| media-libs/libextractor | * | < 0.5.9 | >= 0.5.9 |
Xpdf is a PDF file viewer that runs under the X Window System. Poppler is a PDF rendering library based on the Xpdf 3.0 code base. GPdf is a PDF file viewer for the GNOME 2 platform, also based on Xpdf. libextractor is a library which includes Xpdf code to extract arbitrary meta-data from files. pdftohtml is a utility to convert PDF files to HTML or XML formats that makes use of Xpdf code to decode PDF files.
Chris Evans has reported some integer overflows in Xpdf when attempting to calculate buffer sizes for memory allocation, leading to a heap overflow and a potential infinite loop when handling malformed input files.
By sending a specially crafted PDF file to a victim, an attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.01-r5"
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.4.3-r4"
All GPdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r3"
All libextractor users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libextractor-0.5.9"
All pdftohtml users should migrate to the latest stable version of Poppler.
Multiple vulnerabilities have been discovered in Xpdf, GPdf, CUPS and Poppler potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/gpdf | * | < 2.10.0-r2 | >= 2.10.0-r2 |
| app-text/poppler | * | < 0.4.2-r1 | >= 0.4.2-r1, >= 0.3.0-r1 (revision) |
| app-text/xpdf | * | < 3.01-r2 | >= 3.01-r2 |
| net-print/cups | * | < 1.1.23-r3 | >= 1.1.23-r3 |
Xpdf and GPdf are PDF file viewers that run under the X Window System. Poppler is a PDF rendering library based on Xpdf code. The Common UNIX Printing System (CUPS) is a cross-platform print spooler. It makes use of Xpdf code to handle PDF files.
infamous41md discovered that several Xpdf functions lack sufficient boundary checking, resulting in multiple exploitable buffer overflows.
An attacker could entice a user to open a specially-crafted PDF file which would trigger an overflow, potentially resulting in execution of arbitrary code with the rights of the user running Xpdf, CUPS, GPdf or Poppler.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.01-r2"
All GPdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r2"
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose app-text/poppler
All CUPS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-print/cups-1.1.23-r3"