CVE-2010-3702 The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attac...
HighCVSS 7.5
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apple cups | <= 1.3.11 | No fix listed |
| freedesktop poppler | >= 0.8.7, <= 0.15.1 | No fix listed |
| xpdfreader xpdf | <= 3.01 | No fix listed |
| xpdfreader xpdf | = 3.02 | No fix listed |
| xpdfreader xpdf | = 3.02-pl1 | No fix listed |
| xpdfreader xpdf | = 3.02-pl2 | No fix listed |
| xpdfreader xpdf | = 3.02-pl3 | No fix listed |
| xpdfreader xpdf | = 3.02-pl4 | No fix listed |
| fedoraproject fedora | = 12 | No fix listed |
| fedoraproject fedora | = 13 | No fix listed |
| fedoraproject fedora | = 14 | No fix listed |
| opensuse | = 11.1 | No fix listed |
| opensuse | = 11.2 | No fix listed |
| opensuse | = 11.3 | No fix listed |
| SUSE linux enterprise server | = 9 | No fix listed |
| SUSE linux enterprise server | = 10-sp3 | No fix listed |
| SUSE linux enterprise server | = 11 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Canonical Ubuntu Linux | = 9.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| debian/poppler(Debian:12) | < 0.12.4-1.2 | 0.12.4-1.2 |
| debian/poppler(Debian:13) | < 0.12.4-1.2 | 0.12.4-1.2 |
| debian/poppler(Debian:14) | < 0.12.4-1.2 | 0.12.4-1.2 |
| debian/xpdf(Debian:12) | < 3.02-9 | 3.02-9 |
| debian/xpdf(Debian:13) | < 3.02-9 | 3.02-9 |
| debian/xpdf(Debian:14) | < 3.02-9 | 3.02-9 |
| ubuntu/ipe(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-1005-1 vendor-advisory
- www.cve.org
- cgit.freedesktop.org patch vendor-advisory
- FEDORA-2010-16744 third-party-advisory vendor-advisory
- FEDORA-2010-16662 third-party-advisory vendor-advisory
- FEDORA-2010-16705 third-party-advisory vendor-advisory
- FEDORA-2010-15857 third-party-advisory vendor-advisory
- FEDORA-2010-15911 third-party-advisory vendor-advisory
- FEDORA-2010-15981 third-party-advisory vendor-advisory
- SUSE-SR:2010:022 mailing-list third-party-advisory vendor-advisory
- SUSE-SR:2010:023 mailing-list third-party-advisory vendor-advisory
- SUSE-SR:2010:024 mailing-list third-party-advisory vendor-advisory
- RHSA-2012:1201 third-party-advisory vendor-advisory
- 42141 third-party-advisory
- 42357 third-party-advisory
- 42397 third-party-advisory
- 42691 third-party-advisory
- 43079 third-party-advisory
- SSA:2010-324-01 third-party-advisory vendor-advisory
- DSA-2119 third-party-advisory vendor-advisory
- DSA-2135 third-party-advisory vendor-advisory
- MDVSA-2010:228 third-party-advisory vendor-advisory
- MDVSA-2010:229 third-party-advisory vendor-advisory
- MDVSA-2010:230 third-party-advisory vendor-advisory
- MDVSA-2010:231 third-party-advisory vendor-advisory
- MDVSA-2012:144 third-party-advisory vendor-advisory
- www.openoffice.org third-party-advisory
- [oss-security] 20101004 Re: CVE requests: Poppler, Quassel, Pyfribidi, Overkill, DocUtils, FireGPG, Wireshark mailing-list patch third-party-advisory
- RHSA-2010:0749 third-party-advisory vendor-advisory
- RHSA-2010:0750 third-party-advisory vendor-advisory
- RHSA-2010:0751 third-party-advisory vendor-advisory
- RHSA-2010:0752 third-party-advisory vendor-advisory
- RHSA-2010:0753 third-party-advisory vendor-advisory
- RHSA-2010:0754 third-party-advisory vendor-advisory
- RHSA-2010:0755 third-party-advisory vendor-advisory
- RHSA-2010:0859 third-party-advisory vendor-advisory
- 43845 third-party-advisory vdb-entry
- USN-1005-1 third-party-advisory vendor-advisory
- ADV-2010-2897 third-party-advisory vdb-entry
- ADV-2010-3097 third-party-advisory vdb-entry
- ADV-2011-0230 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- Debian Security Tracker CVE-2010-3702 vendor-advisory
- bugs.debian.org issue-tracking