UnratedFix available
poppler, xpdf — security advisory
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.
- Products
- poppler, xpdf
- Affected versions
- Not specified
- Fixed versions
- 0.6.4-1, 3.02
- CVEs
- CVE-2008-1693
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:00 UTC · Revision 1
Source evidence
The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.
osv:DEBIAN-CVE-2008-1693
poppler
Fixed versions: 0.6.4-1
poppler
Fixed versions: 0.6.4-1
poppler
Fixed versions: 0.6.4-1
xpdf
Fixed versions: 3.02
xpdf
Fixed versions: 3.02
xpdf
Fixed versions: 3.02
Complete source record
{
"id": "da91edbd09dfb88693f603f903980cba7d3393e772b1c2bbb226d8bed232bac0",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2008-1693",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2008-1693",
"summary": "The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.",
"evidence": "osv:DEBIAN-CVE-2008-1693",
"products": [
{
"name": {
"value": "poppler",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.6.4-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.6.4-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.6.4-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2008-1693",
"aliases": [
"DEBIAN-CVE-2008-1693"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.4-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-1693.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.4-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-1693.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.4-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-1693.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-1693.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-1693.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2008-1693.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:32.144877076Z",
"provider": "osv",
"upstream": [
"CVE-2008-1693"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2008-1693"
]
},
"related_cves": [
{
"value": "CVE-2008-1693",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 417491,
"published_at": "2008-04-18T15:05:00+00:00"
}