CVE-2008-1693

poppler < 0.7.3 - Remote Code Execution via Crafted Font Object

Title source: llm
STIX 2.1

Description

The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.

References (34)

Core 34
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:173
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29869
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11226
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1265/references
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:089
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29884
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30019
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29885
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1019893
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/28830
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29853
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29851
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29816
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:197
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0239.html
Patch vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1548
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1606
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0240.html
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200804-18.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29868
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1266/references
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0262.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31035
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41884
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30033
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29836
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29834
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2008-0238.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-603-2
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-603-1
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2008_13_sr.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30717

Scores

EPSS 0.0494
EPSS Percentile 91.1%

Details

CWE
CWE-20
Status published
Products (29)
poppler/poppler 0.1
poppler/poppler 0.1.1
poppler/poppler 0.1.2
poppler/poppler 0.2.0
poppler/poppler 0.3.0
poppler/poppler 0.3.1
poppler/poppler 0.3.2
poppler/poppler 0.3.3
poppler/poppler 0.4.0
poppler/poppler 0.4.1
... and 19 more
Published Apr 18, 2008
Tracked Since Feb 18, 2026