The PDF viewer Xpdf is prone to multiple vulnerabilities on Linux systems that can lead to arbitrary code execution.

Successful exploitation will let the attacker craft a malicious PDF File and execute arbitrary codes into the context of the affected application to cause denial of service attacks, buffer overflow attacks, remote code executions etc.

Apply Xpdf v3.02 pl3 patch: ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl3.patch

- Integer overflow in Xpdf JBIG2 Decoder which allows the attacker create a malicious crafted PDF File and causes code execution. - Flaws in Xpdf JBIG2 Decoder which causes buffer overflow, freeing of arbitrary memory causing Xpdf application to crash.

Xpdf version 3.02 and prior on Linux.

This test uses the xpdf detection results and checks version of each binary found on the target system. Version 3.02 and prior will raise a security alert.

• http://secunia.com/advisories/34755
• http://www.redhat.com/support/errata/RHSA-2009-0430.html
• https://bugzilla.redhat.com/show_bug.cgi?id=495896

---

Updated on 2015-03-25