CVE-2007-5392: xpdf

CVSS: 9.3v2.0HighModified

AliasesDEBIAN-CVE-2007-5392

Published 08-11-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-5392 is a high (CVSS 9.3) vulnerability in xpdf. EPSS estimates a 6.41% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

6.41%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 14 · Related 1

DSA-1480-1 DSA-1509-1 DSA-1537-1 DTSA-85-1 DTSA-86-1 OPENSUSE-SU-2024:11181-1+8 more

Timeline

08-11-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

6.41%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.41% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.41%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian4 products

cups< 1.1.22-7
libextractor< 0.5.12-1
poppler< 0.6.2-1
xpdf< 3.02-1.3

Xpdf1 product

xpdf3.0.1_pl1

2 vendors · 5 products

References

83 links

www.novell.com/linux/security/advisories/2007_60_pdf.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/27632Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27743Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:222Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2007/3774VDB EntryX Refsource VUPEN
secunia.com/advisories/27260Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
secunia.com/advisories/27856Third Party AdvisoryX Refsource SECUNIA
support.novell.com/techcenter/psdb/da3498f05433976cc548cc4eaf8349c8.htmlX Refsource CONFIRM
secunia.com/advisories/27636Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29604Third Party AdvisoryX Refsource SECUNIA

Show all 83 references

www.mandriva.com/security/advisories?name=MDKSA-2007:223Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27721Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27724Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/3776VDB EntryX Refsource VUPEN
www.redhat.com/archives/fedora-package-announce/2007-November/msg00224.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/27577Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/29104Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2007-November/msg00215.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/27618Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27642Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2007-December/msg00369.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/27656Third Party AdvisoryX Refsource SECUNIA
secunia.com/secunia_research/2007-88/advisory/X Refsource MISCVendor Advisory
www.redhat.com/archives/fedora-package-announce/2007-November/msg00238.htmlVendor AdvisoryX Refsource FEDORA
support.novell.com/techcenter/psdb/1d5fd29802b2ef7e342e733731f1e933.htmlX Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2007-1026.htmlVendor AdvisoryX Refsource REDHAT
www.debian.org/security/2008/dsa-1509Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/support/errata/RHSA-2007-1022.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/27573Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-1029.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/27641Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200805-13.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/28812Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1537Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2007-November/msg00724.htmlVendor AdvisoryX Refsource FEDORA
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.761882Vendor AdvisoryX Refsource SLACKWARE
www.securityfocus.com/bid/26367VDB EntryX Refsource BID
secunia.com/advisories/27615Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-1021.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2007/3786VDB EntryX Refsource VUPEN
secunia.com/advisories/27645Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/483372Mailing ListX Refsource BUGTRAQ
secunia.com/advisories/30168Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27574Third Party AdvisoryX Refsource SECUNIAVendor Advisory
issues.rpath.com/browse/RPL-1926X Refsource CONFIRM
secunia.com/advisories/26503Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2007:219Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2008/dsa-1480Vendor AdvisoryX Refsource DEBIAN
security.gentoo.org/glsa/glsa-200711-22.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/27634Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:227Vendor AdvisoryX Refsource MANDRIVA
www.kde.org/info/security/advisory-20071107-1.txtX Refsource CONFIRM
secunia.com/advisories/28043Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10036VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/27619Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/38303VDB EntryX Refsource XF
www.mandriva.com/security/advisories?name=MDKSA-2007:220Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27705Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27578Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27640Third Party AdvisoryX Refsource SECUNIAVendor Advisory
support.novell.com/techcenter/psdb/43ad7b3569dba59e7ba07677edc01cad.htmlX Refsource CONFIRM
support.novell.com/techcenter/psdb/3867a5092daac43cd6a92e6107d9fbce.htmlX Refsource CONFIRM
security.gentoo.org/glsa/glsa-200711-34.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/27599Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27575Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1018905VDB EntryX Refsource SECTRACK
support.novell.com/techcenter/psdb/f83e024a65d69ebc810d2117815b940d.htmlX Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2007-November/msg00663.htmlVendor AdvisoryX Refsource FEDORA
www.mandriva.com/security/advisories?name=MDKSA-2007:228Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2007/3775VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2007-1027.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2007-1030.htmlVendor AdvisoryX Refsource REDHAT
www.ubuntu.com/usn/usn-542-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/27658Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-1024.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDKSA-2007:230Vendor AdvisoryX Refsource MANDRIVA
www.ubuntu.com/usn/usn-542-2Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2007-1025.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2007/3779VDB EntryX Refsource VUPEN
www.mandriva.com/security/advisories?name=MDKSA-2007:221Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27553Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27637Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security-tracker.debian.org/tracker/CVE-2007-5392Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities