Multiple vulnerabilities have been found in Xpdf, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/xpdf | * | < 4.05 | >= 4.05 |
Xpdf is an X viewer for PDF files.
Multiple vulnerabilities have been discovered in Xpdf. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-4.05"
Multiple vulnerabilities have been discovered in Xpdf, the worst of which could possibly lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/xpdf | * | < 4.04 | >= 4.04 |
Xpdf is an X viewer for PDF files.
Multiple vulnerabilities have been discovered in Xpdf. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-4.04"
Multiple vulnerabilities in Xpdf could result in execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/xpdf | * | <= 3.02-r4 | — |
Xpdf is an X viewer for PDF files.
Multiple vulnerabilities have been discovered in Xpdf. Please review the CVE identifiers referenced below for details.
A context-dependent attacker could execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
Gentoo has discontinued support for Xpdf. We recommend that users unmerge Xpdf:
# emerge --unmerge "app-text/xpdf"
A vulnerability in Xpdf might allow local attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/xpdf | * | < 3.02-r2 | >= 3.02-r2 |
Xpdf is a PDF file viewer that runs under the X Window System.
Erik Wallin reported that Gentoo's Xpdf attempts to read the "xpdfrc" file from the current working directory if it cannot find a ".xpdfrc" file in the user's home directory. This is caused by a missing definition of the SYSTEM_XPDFRC macro when compiling a repackaged version of Xpdf.
A local attacker could entice a user to run "xpdf" from a directory containing a specially crafted "xpdfrc" file, resulting in the execution of arbitrary code when attempting to, e.g., print a file.
Do not run Xpdf from untrusted working directories.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.02-r2"
Xpdf and Poppler are vulnerable to a heap overflow that may be exploited to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/poppler | * | < 0.5.0-r4 | >= 0.5.0-r4 |
| app-text/xpdf | * | < 3.01-r7 | >= 3.01-r7 |
Xpdf is a PDF file viewer that runs under the X Window System. Poppler is a PDF rendering library based on the Xpdf 3.0 code base.
Dirk Mueller has reported a vulnerability in Xpdf. It is caused by a missing boundary check in the splash rasterizer engine when handling PDF splash images with overly large dimensions.
By sending a specially crafted PDF file to a victim, an attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.01-r7"
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.5.0-r4"
Xpdf, Poppler, GPdf, libextractor and pdftohtml are vulnerable to integer overflows that may be exploited to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/gpdf | * | < 2.10.0-r3 | >= 2.10.0-r3 |
| app-text/pdftohtml | * | < 0.36-r4 | — |
| app-text/poppler | * | < 0.4.3-r4 | >= 0.4.3-r4 |
| app-text/xpdf | * | < 3.01-r5 | >= 3.01-r5 |
| media-libs/libextractor | * | < 0.5.9 | >= 0.5.9 |
Xpdf is a PDF file viewer that runs under the X Window System. Poppler is a PDF rendering library based on the Xpdf 3.0 code base. GPdf is a PDF file viewer for the GNOME 2 platform, also based on Xpdf. libextractor is a library which includes Xpdf code to extract arbitrary meta-data from files. pdftohtml is a utility to convert PDF files to HTML or XML formats that makes use of Xpdf code to decode PDF files.
Chris Evans has reported some integer overflows in Xpdf when attempting to calculate buffer sizes for memory allocation, leading to a heap overflow and a potential infinite loop when handling malformed input files.
By sending a specially crafted PDF file to a victim, an attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.01-r5"
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.4.3-r4"
All GPdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r3"
All libextractor users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=media-libs/libextractor-0.5.9"
All pdftohtml users should migrate to the latest stable version of Poppler.
Multiple vulnerabilities have been discovered in Xpdf, GPdf, CUPS and Poppler potentially resulting in the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/gpdf | * | < 2.10.0-r2 | >= 2.10.0-r2 |
| app-text/poppler | * | < 0.4.2-r1 | >= 0.4.2-r1, >= 0.3.0-r1 (revision) |
| app-text/xpdf | * | < 3.01-r2 | >= 3.01-r2 |
| net-print/cups | * | < 1.1.23-r3 | >= 1.1.23-r3 |
Xpdf and GPdf are PDF file viewers that run under the X Window System. Poppler is a PDF rendering library based on Xpdf code. The Common UNIX Printing System (CUPS) is a cross-platform print spooler. It makes use of Xpdf code to handle PDF files.
infamous41md discovered that several Xpdf functions lack sufficient boundary checking, resulting in multiple exploitable buffer overflows.
An attacker could entice a user to open a specially-crafted PDF file which would trigger an overflow, potentially resulting in execution of arbitrary code with the rights of the user running Xpdf, CUPS, GPdf or Poppler.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.01-r2"
All GPdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r2"
All Poppler users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose app-text/poppler
All CUPS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-print/cups-1.1.23-r3"
Xpdf, Kpdf and GPdf may crash as a result of a Denial of Service vulnerability.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/gpdf | * | < 2.10.0-r1 | >= 2.10.0-r1 |
| app-text/xpdf | * | < 3.00-r10 | >= 3.00-r10 |
| kde-base/kdegraphics | * | < 3.3.2-r3 | >= 3.3.2-r3 |
| kde-base/kpdf | * | < 3.4.1-r1 | >= 3.4.1-r1 |
Xpdf, Kpdf and GPdf are PDF file viewers that run under the X Window System. Kpdf and GPdf both contain Xpdf code. Kpdf is also part of kdegraphics.
Xpdf, Kpdf and GPdf do not handle a broken table of embedded TrueType fonts correctly. After detecting such a table, Xpdf, Kpdf and GPdf attempt to reconstruct the information in it by decoding the PDF file, which causes the generation of a huge temporary file.
A remote attacker may cause a Denial of Service by creating a specially crafted PDF file, sending it to a CUPS printing system (which uses Xpdf), or by enticing a user to open it in Xpdf, Kpdf, or GPdf.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r10"
All GPdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r1"
All Kpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2-r3"
All KDE Split Ebuild Kpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=kde-base/kpdf-3.4.1-r1"
A stack overflow was discovered in Xpdf, potentially resulting in the execution of arbitrary code. GPdf includes Xpdf code and therefore is vulnerable to the same issue.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/gpdf | * | < 2.8.2 | >= 2.8.2 |
| app-text/xpdf | * | <= 3.00-r7 | >= 3.00-r8 |
Xpdf is an open source viewer for Portable Document Format (PDF) files. GPdf is a Gnome-based PDF viewer that includes some Xpdf code.
iDEFENSE reports that the Decrypt::makeFileKey2 function in Xpdf's Decrypt.cc insufficiently checks boundaries when processing /Encrypt /Length tags in PDF files.
An attacker could entice an user to open a specially-crafted PDF file which would trigger a stack overflow, potentially resulting in execution of arbitrary code with the rights of the user running Xpdf or GPdf.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r8"
All GPdf users should also upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.8.2"
New integer overflows were discovered in Xpdf, potentially resulting in the execution of arbitrary code. GPdf includes Xpdf code and therefore is vulnerable to the same issues.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/gpdf | * | <= 2.8.1 | >= 2.8.1-r1 |
| app-text/xpdf | * | <= 3.00-r6 | >= 3.00-r7 |
Xpdf is an open source viewer for Portable Document Format (PDF) files. GPdf is a Gnome-based PDF viewer that includes some Xpdf code.
A new integer overflow issue was discovered in Xpdf's Gfx::doImage() function.
An attacker could entice an user to open a specially-crafted PDF file, potentially resulting in execution of arbitrary code with the rights of the user running Xpdf or GPdf.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r7"
All GPdf users should also upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.8.1-r1"
Multiple integer overflows were discovered in Xpdf, potentially resulting in execution of arbitrary code upon viewing a malicious PDF file. CUPS includes Xpdf code and therefore is vulnerable to the same issues.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-text/xpdf | * | <= 3.00-r4 | >= 3.00-r5 |
| net-print/cups | * | <= 1.1.20-r4 | >= 1.1.20-r5 |
Xpdf is an open source viewer for Portable Document Format (PDF) files. The Common UNIX Printing System (CUPS) is a cross-platform print spooler that includes some Xpdf code.
Chris Evans discovered multiple integer overflow issues in Xpdf.
An attacker could entice an user to open a specially-crafted PDF file, potentially resulting in execution of arbitrary code with the rights of the user running Xpdf. By enticing an user to directly print the PDF file to a CUPS printer, an attacker could also crash the CUPS spooler or execute arbitrary code with the rights of the CUPS spooler, which is usually the "lp" user.
There is no known workaround at this time.
All Xpdf users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r5"
All CUPS users should also upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-print/cups-1.1.20-r5"