Every CVESearch/Get API key

CVE-2007-0104

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before...

6.8 MediumFix available

CVE-2007-0104 is a medium vulnerability (CVSS 6.8) in Kde, published January 9, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.23%, the 93rd percentile. Fixed in poppler 0.4.5-5.1.

What does this mean?
Severity
6.8 MediumCVSS 2.0, NVD
Exploit chance
6.23%EPSS, 93rd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.4.5-5.1poppler +7 more

Description

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Exploit likelihood

6.23%Down 0.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
poppler
Debian:12
before 0.4.5-5.1
0.4.5-5.1
poppler
Debian:13
before 0.4.5-5.1
0.4.5-5.1
poppler
Debian:14
before 0.4.5-5.1
0.4.5-5.1
xpdf
Debian:12
before 3.02
3.02
xpdf
Debian:13
before 3.02
3.02
xpdf
Debian:14
before 3.02
3.02
cups
openSUSE:Tumbleweed
From an advisory covering 20 CVEs
before 2.3.3op2-4.2
2.3.3op2-4.2
poppler
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
before 21.08.0-1.3
21.08.0-1.3

What each source reports

NVD Score used6.8

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Record
CVE-2007-0104
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Record
CVE-2007-0104
Updated
2026-11-02
EUVDEUVD-2007-0108No score

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Record
EUVD-2007-0108
Updated
2026-11-03
GitHub AdvisoriesGHSA-8w95-hg52-rgm5No score

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before...

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Record
GHSA-8w95-hg52-rgm5
Weakness
CWE-20
Updated
2026-11-02
OSVNo score

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Record
CVE-2007-0104
Updated
2026-11-02
OSVDEBIAN-CVE-2007-0104No score

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Record
DEBIAN-CVE-2007-0104
Updated
2026-11-02
OSVopenSUSE-SU-2024:10707-1No score

cups-2.3.3op2-4.2 on GA media

These are all security issues fixed in the cups-2.3.3op2-4.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10707-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11181-1No score

libpoppler-cpp0-21.08.0-1.3 on GA media

These are all security issues fixed in the libpoppler-cpp0-21.08.0-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11181-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 57 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open