CVE-2013-4472
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on...
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
Exploit likelihood
What each source reports
NVD Score used
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
- Record
CVE-2013-4472- CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
- Record
CVE-2013-4472- Updated
- 2026-11-02
EUVDEUVD-2013-4340 No score
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
- Record
EUVD-2013-4340- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6g5q-pc77-85j9 No score
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on...
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
- Record
GHSA-6g5q-pc77-85j9- Weakness
- CWE-59
- Updated
- 2026-11-02
OSV No score
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
- Record
CVE-2013-4472- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4472 No score
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
- Record
DEBIAN-CVE-2013-4472- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
All versions, plus listed versions 22.12.0-222.12.0-2+deb12u122.12.0-2+deb12u222.12.0-2+deb12u322.12.0-2.1 Show 40 moreShow less22.12.0-2.223.08.0-123.08.0-223.12.0-124.02.0-124.02.0-224.02.0-324.02.0-424.02.0-524.02.0-5+loong6424.06.0-124.06.0-224.08.0-124.08.0-224.08.0-324.08.0-425.01.0-125.01.0-225.01.0-325.01.0-425.01.0-525.03.0-125.03.0-1025.03.0-1125.03.0-11.125.03.0-225.03.0-325.03.0-425.03.0-525.03.0-625.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-2 |
None known |
popplerDebian:13 |
All versions, plus listed versions 25.03.0-1025.03.0-1125.03.0-11.125.03.0-525.03.0-5+deb13u2 Show 13 moreShow less25.03.0-5+deb13u325.03.0-5+deb13u425.03.0-625.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-2 |
None known |
popplerDebian:14 |
All versions, plus listed versions 25.03.0-1025.03.0-1125.03.0-11.125.03.0-525.03.0-6 Show 10 moreShow less25.03.0-725.03.0-926.01.0-126.01.0-226.01.0-326.01.0-426.01.0-4.126.01.0-526.07.0-126.07.0-2 |
None known |
xpdfDebian:12 |
All versions, plus listed versions 3.04+git20220601-13.04+git20231213-13.04+git20240118-13.04+git20240124-13.04+git20240202-1 Show 5 moreShow less3.04+git20240613-13.04+git20250103-13.04+git20250304-13.04+git20260220-13.04+git20260802-1 |
None known |
xpdfDebian:13 |
All versions, plus listed versions 3.04+git20250304-13.04+git20260220-13.04+git20260802-1 |
None known |
xpdfDebian:14 |
All versions, plus listed versions 3.04+git20250304-13.04+git20260220-13.04+git20260802-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4472 is a low vulnerability (CVSS 3.3) in Freedesktop Poppler, published April 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. No source names a fixed version.