CVE-2004-0888: Debian Linux

High severity, CVSS 10.0. EPSS: 9.5% chance of exploitation in the next 30 days.

Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.

Affected products

• Debian Debian Linux: version 3.0 only
• Easy Software Products Cups: version 1.0.4 only; version 1.0.4_8 only; version 1.1.1 only; version 1.1.4 only; version 1.1.4_2 only; version 1.1.4_3 only; …
• Gentoo Linux: any version
• Gnome Gpdf: version 0.112 only; version 0.131 only
• Kde Kde: version 3.2 only; version 3.2.1 only; version 3.2.2 only; version 3.2.3 only; version 3.3 only; version 3.3.1 only
• Kde Koffice: version 1.3 only; version 1.3.1 only; version 1.3.2 only; version 1.3.3 only; version 1.3_beta1 only; version 1.3_beta2 only; …
• Kde Kpdf: version 3.2 only
• Pdftohtml Pdftohtml: version 0.32a only; version 0.32b only; version 0.33 only; version 0.33a only; version 0.34 only; version 0.35 only; …
• Red Hat Enterprise Linux: version 2.1 only; version 3.0 only
• Red Hat Enterprise Linux Desktop: version 3.0 only
• Red Hat Fedora Core: version core_2.0 only
• Red Hat Linux Advanced Workstation: version 2.1 only
• Suse Suse Linux: version 8.0 only; version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only; version 9.2 only
• Tetex Tetex: version 1.0.7 only; version 2.0 only; version 2.0.1 only; version 2.0.2 only
• Ubuntu Ubuntu Linux: version 4.1 only
• Xpdf Xpdf: version 0.90 only; version 0.91 only; version 0.92 only; version 0.93 only; version 1.0 only; version 1.0a only; …

Published 2005-01-27. Last modified 2026-06-16.