Skip to content
Fencer Vulns
high 7.6

CVE-2007-4352 json

Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffi…

published 2007-11-08 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-4335

cvss
7.6
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
7.0%
EPSS 7.0% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.

Patch / fix

  • cups Debian 14, Debian 13, Debian 12 1.1.22-7
  • xpdf Debian 14, Debian 13, Debian 12 3.02-1.3
  • poppler Debian 14, Debian 13, Debian 12 0.6.2-1
  • libextractor Debian 14, Debian 13, Debian 12 0.5.12-1

debian advisories DEBIAN-CVE-2007-4352

  • xpdf RHEL 4 1:3.00-14.el4
  • tetex RHEL 4 2.0.2-22.0.1.EL4.10
  • tetex RHEL 5 3.0-33.2.el5_1.2
  • tetex-afm RHEL 4 2.0.2-22.0.1.EL4.10
  • tetex-afm RHEL 5 3.0-33.2.el5_1.2
  • tetex-xdvi RHEL 4 2.0.2-22.0.1.EL4.10
  • tetex-xdvi RHEL 5 3.0-33.2.el5_1.2
  • tetex-dvips RHEL 4 2.0.2-22.0.1.EL4.10

red hat advisories RHSA-2007:1029RHSA-2007:1027RHSA-2007:1030RHSA-2007:1026RHSA-2007:1025RHSA-2007:1024

  • cups openSUSE Tumbleweed 2.3.3op2-4.2
  • poppler openSUSE Tumbleweed 21.08.0-1.3

opensuse advisories openSUSE-SU-2024:10707-1openSUSE-SU-2024:11181-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2007-4352 updated

DCTStream:: readProgressiveDataUnit()

  • Red Hat Desktop version 3 xpdf 2.02-11.el3
    fixed: vendor fix RHSA-2007:1030
  • Red Hat Enterprise Linux (v. 5 server) tetex 3.0-33.2.el5_1.2, poppler 0.5.4-4.3.el5_1, cups 1.2.4-11.14.el5_1.3, tetex-afm 3.0-33.2.el5_1.2, tetex-xdvi 3.0-33.2.el5_1.2, cups-lpd 1.2.4-11.14.el5_1.3, +5 more
    fixed: vendor fix RHSA-2007:1027
  • Red Hat Enterprise Linux AS version 3 xpdf 2.02-11.el3
    fixed: vendor fix RHSA-2007:1030
  • Red Hat Enterprise Linux AS version 4 gpdf 2.8.2-7.7.1, xpdf 3.00-14.el4, kdegraphics 3.3.1-6.el4_5, tetex 2.0.2-22.0.1.EL4.10, tetex-afm 2.0.2-22.0.1.EL4.10, tetex-xdvi 2.0.2-22.0.1.EL4.10, +5 more
    fixed: vendor fix RHSA-2007:1022
  • Red Hat Enterprise Linux Desktop (v. 5 client) tetex 3.0-33.2.el5_1.2, poppler 0.5.4-4.3.el5_1, cups 1.2.4-11.14.el5_1.3, tetex-afm 3.0-33.2.el5_1.2, tetex-xdvi 3.0-33.2.el5_1.2, cups-lpd 1.2.4-11.14.el5_1.3, +5 more
    fixed: vendor fix RHSA-2007:1027
  • Red Hat Enterprise Linux Desktop version 4 gpdf 2.8.2-7.7.1, xpdf 3.00-14.el4, kdegraphics 3.3.1-6.el4_5, tetex 2.0.2-22.0.1.EL4.10, tetex-afm 2.0.2-22.0.1.EL4.10, tetex-xdvi 2.0.2-22.0.1.EL4.10, +5 more
    fixed: vendor fix RHSA-2007:1022
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) poppler 0.5.4-4.3.el5_1, cups 1.2.4-11.14.el5_1.3, cups-lpd 1.2.4-11.14.el5_1.3, cups-libs 1.2.4-11.14.el5_1.3, poppler-utils 0.5.4-4.3.el5_1
    fixed: vendor fix RHSA-2007:1021
  • Red Hat Enterprise Linux ES version 3 xpdf 2.02-11.el3
    fixed: vendor fix RHSA-2007:1030
show 3 more
  • Red Hat Enterprise Linux ES version 4 gpdf 2.8.2-7.7.1, xpdf 3.00-14.el4, kdegraphics 3.3.1-6.el4_5, tetex 2.0.2-22.0.1.EL4.10, tetex-afm 2.0.2-22.0.1.EL4.10, tetex-xdvi 2.0.2-22.0.1.EL4.10, +5 more
    fixed: vendor fix RHSA-2007:1022
  • Red Hat Enterprise Linux WS version 3 xpdf 2.02-11.el3
    fixed: vendor fix RHSA-2007:1030
  • Red Hat Enterprise Linux WS version 4 gpdf 2.8.2-7.7.1, xpdf 3.00-14.el4, kdegraphics 3.3.1-6.el4_5, tetex 2.0.2-22.0.1.EL4.10, tetex-afm 2.0.2-22.0.1.EL4.10, tetex-xdvi 2.0.2-22.0.1.EL4.10, +5 more
    fixed: vendor fix RHSA-2007:1022

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

7.02% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.