CVE-2010-3702
The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.
- EPSS
- 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-476
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:cups
- canonical:ubuntu_linux
- debian:debian_linux
- fedoraproject:fedora
- freedesktop:poppler
- opensuse:opensuse
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_server
- redhat:enterprise_linux_workstation
- suse:linux_enterprise_server
- xpdfreader:xpdf
References
- ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl5.patch
- http://cgit.freedesktop.org/poppler/poppler/commit/?id=e853106b58d6b4b0467dbd6436c9bb1cfbd372cf
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050268.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050285.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050390.html