MEDIUM
xpdf: embedded font vulnerability
Published Apr 18, 2008
6.8
MEDIUMCVSS 2.0
EPSS 4.94%
Description
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.
Affected products
No data.
OR
- ≤ 0.7.3
- 0.1
- 0.1.1
- 0.1.2
- 0.2.0
- 0.3.0
- 0.3.1
- 0.3.2
- 0.3.3
- 0.4.0
- 0.4.1
- 0.4.2
- 0.4.3
- 0.4.4
- 0.5.0
- 0.5.1
- 0.5.2
- 0.5.3
- 0.5.4
- 0.5.9
- 0.5.91
- 0.6.0
- 0.6.1
- 0.6.2
- 0.6.3
- 0.6.4
- 0.7.0
- 0.7.1
- 0.7.2
No data.
Red Hat Enterprise Linux 4
gpdf-0:2.8.2-7.7.2
Fixed · RHSA-2008:0262
Red Hat Enterprise Linux 4
kdegraphics-7:3.3.1-9.el4_6
Fixed · RHSA-2008:0238
Red Hat Enterprise Linux 4
xpdf-1:3.00-16.el4
Fixed · RHSA-2008:0240
Red Hat Enterprise Linux 5
poppler-0:0.5.4-4.4.el5_1
Fixed · RHSA-2008:0239
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 4 | gpdf-0:2.8.2-7.7.2 | Fixed | RHSA-2008:0262 |
| Red Hat Enterprise Linux 4 | kdegraphics-7:3.3.1-9.el4_6 | Fixed | RHSA-2008:0238 |
| Red Hat Enterprise Linux 4 | xpdf-1:3.00-16.el4 | Fixed | RHSA-2008:0240 |
| Red Hat Enterprise Linux 5 | poppler-0:0.5.4-4.4.el5_1 | Fixed | RHSA-2008:0239 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
6.8 MEDIUM NVD
AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.94% 0.04941
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.04941
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (15 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 4.94% (0.04941) | 91.88th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.94% (0.04941) | 91.00th | v5 (v2026.06.15) |
| Jun 15, 2025 | 6.88% (0.06879) | 90.89th | v4 (v2025.03.14) |
| Mar 30, 2025 | 7.92% (0.07923) | 91.23th | v4 (v2025.03.14) |
| Mar 29, 2025 | 11.04% (0.11035) | 89.04th | v4 (v2025.03.14) |
| Mar 17, 2025 | 7.92% (0.07923) | 91.43th | v4 (v2025.03.14) |
| Feb 20, 2025 | 17.01% (0.17010) | 96.12th | v3 (v2023.03.01) |
| Dec 12, 2024 | 19.24% (0.19237) | 96.46th | v3 (v2023.03.01) |
| Sep 20, 2024 | 18.70% (0.18700) | 96.32th | v3 (v2023.03.01) |
| Apr 24, 2024 | 13.05% (0.13055) | 95.44th | v3 (v2023.03.01) |
| Mar 19, 2024 | 9.51% (0.09513) | 94.60th | v3 (v2023.03.01) |
| Mar 7, 2023 | 9.03% (0.09027) | 93.59th | v3 (v2023.03.01) |
| Mar 6, 2023 | 9.92% (0.09915) | 94.52th | v2 (v2022.01.01) |
| Apr 1, 2022 | 9.92% (0.09915) | 94.04th | v2 (v2022.01.01) |
| Feb 4, 2022 | 9.92% (0.09915) | 87.53th | v2 (v2022.01.01) |
Weaknesses (1)
References (38)
- http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html vendor-advisoryx_refsource_SUSE
- http://secunia.com/advisories/29816 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29834 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29836 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29851 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29853 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29868 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29869 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29884 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/29885 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/30019 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/30033 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/30717 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/31035 third-party-advisoryx_refsource_SECUNIA
- http://security.gentoo.org/glsa/glsa-200804-18.xml vendor-advisoryx_refsource_GENTOO
- http://securitytracker.com/id?1019893 vdb-entryx_refsource_SECTRACK
- http://www.debian.org/security/2008/dsa-1548 vendor-advisoryx_refsource_DEBIANPatch
- http://www.debian.org/security/2008/dsa-1606 vendor-advisoryx_refsource_DEBIAN
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:089 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:173 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:197 vendor-advisoryx_refsource_MANDRIVA
- http://www.novell.com/linux/security/advisories/2008_13_sr.html vendor-advisoryx_refsource_SUSE
- http://www.redhat.com/support/errata/RHSA-2008-0238.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2008-0239.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2008-0240.html vendor-advisoryx_refsource_REDHAT
- http://www.redhat.com/support/errata/RHSA-2008-0262.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/bid/28830 vdb-entryx_refsource_BID
- http://www.ubuntu.com/usn/usn-603-1 vendor-advisoryx_refsource_UBUNTU
- http://www.ubuntu.com/usn/usn-603-2 vendor-advisoryx_refsource_UBUNTU
- http://www.vupen.com/english/advisories/2008/1265/references vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2008/1266/references vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2008-1693 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=441722 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41884 vdb-entryx_refsource_XF
- https://nvd.nist.gov/vuln/detail/CVE-2008-1693
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11226 vdb-entrysignaturex_refsource_OVAL
- https://www.cve.org/CVERecord?id=CVE-2008-1693
- https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00522.html vendor-advisoryx_refsource_FEDORA
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner canonical
Published Apr 18, 2008
Updated Aug 7, 2024
Reserved Apr 8, 2008
Link CVE-2008-1693
CISA Vulnrichment
Updated n/a