CVE-2008-1693

Published: Apr 18, 2008Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.

Affected (29)

Products: Poppler: Poppler

Poppler

1 product

Poppler

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Poppler Poppler	Up to 0.7.3
Poppler Poppler	Version 0.1.1
Poppler Poppler	Version 0.1.2
Poppler Poppler	Version 0.1
Poppler Poppler	Version 0.2.0
Poppler Poppler	Version 0.3.0
Poppler Poppler	Version 0.3.1
Poppler Poppler	Version 0.3.2
Poppler Poppler	Version 0.3.3
Poppler Poppler	Version 0.4.0
Poppler Poppler	Version 0.4.1
Poppler Poppler	Version 0.4.2
Poppler Poppler	Version 0.4.3
Poppler Poppler	Version 0.4.4
Poppler Poppler	Version 0.5.0
Poppler Poppler	Version 0.5.1
Poppler Poppler	Version 0.5.2
Poppler Poppler	Version 0.5.3
Poppler Poppler	Version 0.5.4
Poppler Poppler	Version 0.5.91
Poppler Poppler	Version 0.5.9
Poppler Poppler	Version 0.6.0
Poppler Poppler	Version 0.6.1
Poppler Poppler	Version 0.6.2
Poppler Poppler	Version 0.6.3
Poppler Poppler	Version 0.6.4
Poppler Poppler	Version 0.7.0
Poppler Poppler	Version 0.7.1
Poppler Poppler	Version 0.7.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (68)

http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html

Source: security@ubuntu.com

http://secunia.com/advisories/29816

Source: security@ubuntu.com

http://secunia.com/advisories/29834

Source: security@ubuntu.com

http://secunia.com/advisories/29836

Source: security@ubuntu.com

http://secunia.com/advisories/29851

Source: security@ubuntu.com

http://secunia.com/advisories/29853

Source: security@ubuntu.com

http://secunia.com/advisories/29868

Source: security@ubuntu.com

http://secunia.com/advisories/29869

Source: security@ubuntu.com

http://secunia.com/advisories/29884

Source: security@ubuntu.com

http://secunia.com/advisories/29885

Source: security@ubuntu.com

http://secunia.com/advisories/30019

Source: security@ubuntu.com

http://secunia.com/advisories/30033

Source: security@ubuntu.com

http://secunia.com/advisories/30717

Source: security@ubuntu.com

http://secunia.com/advisories/31035

Source: security@ubuntu.com

http://security.gentoo.org/glsa/glsa-200804-18.xml

Source: security@ubuntu.com

http://securitytracker.com/id?1019893

Source: security@ubuntu.com

http://www.debian.org/security/2008/dsa-1548

Source: security@ubuntu.com

Patch

http://www.debian.org/security/2008/dsa-1606

Source: security@ubuntu.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:089

Source: security@ubuntu.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:173

Source: security@ubuntu.com

http://www.mandriva.com/security/advisories?name=MDVSA-2008:197

Source: security@ubuntu.com

http://www.novell.com/linux/security/advisories/2008_13_sr.html

Source: security@ubuntu.com

http://www.redhat.com/support/errata/RHSA-2008-0238.html

Source: security@ubuntu.com

http://www.redhat.com/support/errata/RHSA-2008-0239.html

Source: security@ubuntu.com

http://www.redhat.com/support/errata/RHSA-2008-0240.html

Source: security@ubuntu.com

http://www.redhat.com/support/errata/RHSA-2008-0262.html

Source: security@ubuntu.com

http://www.securityfocus.com/bid/28830

Source: security@ubuntu.com

http://www.ubuntu.com/usn/usn-603-1

Source: security@ubuntu.com

http://www.ubuntu.com/usn/usn-603-2

Source: security@ubuntu.com

http://www.vupen.com/english/advisories/2008/1265/references

Source: security@ubuntu.com

http://www.vupen.com/english/advisories/2008/1266/references

Source: security@ubuntu.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/41884

Source: security@ubuntu.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11226

Source: security@ubuntu.com

https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00522.html

Source: security@ubuntu.com

http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html