XP
Product
Xpdf
On CISA KEVExploited in the wild
82
CVEs
1
On KEV
8.2
Max CVSS
0
New 30D
Severity mix
Critical 0High 16Medium 62Low 2
Watch
Add Xpdf to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-10021 | 5.5 | Mar 25 | An issue was discovered in Xpdf 4.01.01 Affected: 4.01.01 |
| CVE-2019-10020 | 5.5 | Mar 25 | An issue was discovered in Xpdf 4.01.01 Affected: 4.01.01 |
| CVE-2019-10019 | 5.5 | Mar 25 | An issue was discovered in Xpdf 4.01.01 Affected: 4.01.01 |
| CVE-2019-10018 | 5.5 | Mar 25 | An issue was discovered in Xpdf 4.01.01 Affected: 4.01.01 |
| CVE-2018-18651 | 5.5 | Oct 25 | An issue was discovered in Xpdf 4.00 Affected: 4.00 |
| CVE-2018-18650 | 5.5 | Oct 25 | An issue was discovered in Xpdf 4.00 Affected: 4.00 |
| CVE-2018-18459 | 5.5 | Oct 18 | The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf file, as demonstrated… Affected: 4.00 |
| CVE-2018-18458 | 5.5 | Oct 18 | The function DCTStream::decodeImage in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf file, as… Affected: 4.00 |
| CVE-2018-18457 | 5.5 | Oct 18 | The function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf file, as demonstrated… Affected: 4.00 |
| CVE-2018-18456 | 5.5 | Oct 18 | The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buffer over-read) via a… Affected: 4.00 |
| CVE-2018-18455 | 5.5 | Oct 18 | The GfxImageColorMap class in GfxState.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file, as demonstrated… Affected: 4.00 |
| CVE-2018-18454 | 5.5 | Oct 18 | CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file, as demonstrated by… Affected: 4.00 |
| CVE-2018-16369 | 5.5 | Sep 3 | XRef::fetch in XRef.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (stack consumption) via a crafted pdf file, related to AcroForm::scanField, as… Affected: 4.00 |
| CVE-2018-16368 | 5.5 | Sep 3 | SplashXPath::strokeAdjust in splash/SplashXPath.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file, as… Affected: 4.00 |
| CVE-2018-8107 | 5.5 | Mar 14 | The JPXStream::close function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf… Affected: 4.00 |
| CVE-2018-8106 | 5.5 | Mar 14 | The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a… Affected: 4.00 |
| CVE-2018-8105 | 5.5 | Mar 14 | The JPXStream::fillReadBuf function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific… Affected: 4.00 |
| CVE-2018-8104 | 5.5 | Mar 14 | The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a specific pdf… Affected: 4.00 |
| CVE-2018-8103 | 5.5 | Mar 14 | The JBIG2Stream::readGenericBitmap function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a… Affected: 4.00 |
| CVE-2018-8102 | 5.5 | Mar 14 | The JBIG2MMRDecoder::getBlackCode function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (buffer over-read and application crash) via a specific pdf… Affected: 4.00 |
| CVE-2018-8101 | 5.5 | Mar 14 | The JPXStream::inverseTransformLevel function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via a… Affected: 4.00 |
| CVE-2018-7455 | 5.5 | Feb 24 | An out-of-bounds read in JPXStream::readTilePart in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml Affected: 4.00 |
| CVE-2018-7454 | 5.5 | Feb 24 | A NULL pointer dereference in XFAForm::scanFields in XFAForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by pdftohtml Affected: 4.00 |
| CVE-2018-7453 | 5.5 | Feb 24 | Infinite recursion in AcroForm::scanField in AcroForm.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file due to lack of loop checking, as… Affected: 4.00 |
| CVE-2018-7452 | 5.5 | Feb 24 | A NULL pointer dereference in JPXStream::fillReadBuf in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service via a specific pdf file, as demonstrated by… Affected: 4.00 |
| CVE-2018-7175 | 5.5 | Feb 15 | An issue was discovered in xpdf 4.00 Affected: 4.00 |
| CVE-2018-7174 | 5.5 | Feb 15 | An issue was discovered in xpdf 4.00 Affected: 4.00 |
| CVE-2018-7173 | 5.5 | Feb 15 | A large loop in JBIG2Stream::readSymbolDictSeg in xpdf 4.00 allows an attacker to cause denial of service via a specific file due to inappropriate decoding Affected: 4.00 |
| CVE-2023-3436 | 3.3 | Jun 27 | Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream Affected: 4.04 |
| CVE-2023-3044 | 3.3 | Jun 2 | An excessively large PDF page size (found in fuzz testing, unlikely in normal PDF files) can result in a divide-by-zero in Xpdf's text extraction code Affected: before 4.05 |
| CVE-2010-3702 | – | Nov 5 | The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows… Affected: through 3.01; 3.02; 3.02; 3.02; 3.02; 3.02 |
| CVE-2007-3387 | – | Jul 30 | Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS,… Affected: 3.02 |