CVE-2004-0889: Debian Linux

High severity, CVSS 10.0. EPSS: 6.2% chance of exploitation in the next 30 days.

Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.

Affected products

• Debian Debian Linux: version 3.0 only
• Easy Software Products Cups: version 1.0.4 only; version 1.0.4_8 only; version 1.1.1 only; version 1.1.4 only; version 1.1.4_2 only; version 1.1.4_3 only; …
• Gentoo Linux: any version
• Gnome Gpdf: version 0.112 only; version 0.131 only
• Kde Kde: version 3.2 only; version 3.2.1 only; version 3.2.2 only; version 3.2.3 only; version 3.3 only; version 3.3.1 only
• Kde Koffice: version 1.3 only; version 1.3.1 only; version 1.3.2 only; version 1.3.3 only; version 1.3_beta1 only; version 1.3_beta2 only; …
• Kde Kpdf: version 3.2 only
• Pdftohtml Pdftohtml: version 0.32a only; version 0.32b only; version 0.33 only; version 0.33a only; version 0.34 only; version 0.35 only; …
• Red Hat Enterprise Linux: version 2.1 only; version 3.0 only
• Red Hat Enterprise Linux Desktop: version 3.0 only
• Red Hat Fedora Core: version core_2.0 only
• Red Hat Linux Advanced Workstation: version 2.1 only
• Suse Suse Linux: version 8.0 only; version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only; version 9.2 only
• Tetex Tetex: version 1.0.7 only; version 2.0 only; version 2.0.1 only; version 2.0.2 only
• Ubuntu Ubuntu Linux: version 4.1 only
• Xpdf Xpdf: version 0.90 only; version 0.91 only; version 0.92 only; version 0.93 only; version 1.0 only; version 1.0a only; …

Published 2005-01-27. Last modified 2026-06-16.