CVE catalog

CVE-2007-3387

cups: CVE-2007-3387

Severity: Low
Published: Jul 30, 2007, 6:02:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 8.57% · Oct 25, 2026

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ipe	sid	`7.2.30-2`	not affected
Debian	ipe	forky	`7.2.30-2`	not affected
Debian	ipe	trixie	`7.2.30-1`	not affected
Debian	ipe	bookworm	`7.2.26+dfsg1-3`	not affected
Debian	cups	sid	`2.4.20-1`	not affected
Debian	cups	forky	`2.4.18-1`	not affected
Debian	cups	trixie	`2.4.10-3+deb13u2`	not affected
Debian	cups	trixie-security	`2.4.10-3+deb13u1`	not affected
Debian	cups	bookworm	`2.4.2-3+deb12u9`	not affected
Debian	cups	bookworm-security	`2.4.2-3+deb12u9`	not affected
Debian	xpdf	sid	`3.04+git20260802-1`	fixed
Debian	xpdf	forky	`3.04+git20260802-1`	fixed
Debian	xpdf	trixie	`3.04+git20250304-1`	fixed
Debian	xpdf	bookworm	`3.04+git20220601-1`	fixed
Debian	poppler	sid	`26.07.0-3`	fixed
Debian	poppler	forky	`26.07.0-3`	fixed
Debian	poppler	trixie	`25.03.0-5+deb13u4`	fixed
Debian	poppler	trixie-security	`25.03.0-5+deb13u3`	fixed
Debian	poppler	bookworm	`22.12.0-2+deb12u2`	fixed
Debian	poppler	bookworm-security	`22.12.0-2+deb12u3`	fixed
Debian	libextractor	sid	`1:1.19-2`	fixed
Debian	libextractor	forky	`1:1.19-2`	fixed
Debian	libextractor	trixie	`1:1.13-8`	fixed
Debian	libextractor	bookworm	`1:1.11-7`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ipe	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	ipe	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	ipe	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	ipe	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Debian	cups	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	cups	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	cups	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	cups	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Debian	xpdf	source	sid	`3.02-1.1`	not yet assigned	Not reported	[435462]
Debian	xpdf	source	forky	`3.02-1.1`	not yet assigned	Not reported	[435462]
Debian	xpdf	source	trixie	`3.02-1.1`	not yet assigned	Not reported	[435462]
Debian	xpdf	source	bookworm	`3.02-1.1`	not yet assigned	Not reported	[435462]
Debian	poppler	source	sid	`0.5.4-6.1`	not yet assigned	Not reported	[435460]
Debian	poppler	source	forky	`0.5.4-6.1`	not yet assigned	Not reported	[435460]
Debian	poppler	source	trixie	`0.5.4-6.1`	not yet assigned	Not reported	[435460]
Debian	poppler	source	bookworm	`0.5.4-6.1`	not yet assigned	Not reported	[435460]
Debian	libextractor	source	sid	`0.5.12-1`	not yet assigned	Not reported	Not reported
Debian	libextractor	source	forky	`0.5.12-1`	not yet assigned	Not reported	Not reported
Debian	libextractor	source	trixie	`0.5.12-1`	not yet assigned	Not reported	Not reported
Debian	libextractor	source	bookworm	`0.5.12-1`	not yet assigned	Not reported	Not reported

[Debian bug #435462][Debian bug #435460]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[cups]Unknown
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-bsd]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-client]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-common]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · all · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · all · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · all · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · all · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-core-drivers]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-daemon]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-ipp-utils]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-ppdc]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[cups-server-common]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · all · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · all · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · all · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · all · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[extract]Unknown
Source package: [libextractor]
Details (2)
- 1:1.11-7 · amd64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
- 1:1.11-7 · arm64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
[gir1.2-poppler-0.18]Unknown
Source package: [poppler]
Details (4)
- 22.12.0-2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 0.5.4-6.1
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 0.5.4-6.1
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 0.5.4-6.1
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
- 22.12.0-2+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 0.5.4-6.1
  dsa · poppler · debian · bookworm; dsa · poppler · debian · 12
[ipe]Unknown
Source package: [ipe]
Details (2)
- 7.2.26+dfsg1-3+b1 · amd64 · bookworm
  Not affected
  dsa · ipe · debian · bookworm
- 7.2.26+dfsg1-3+b1 · arm64 · bookworm
  Not affected
  dsa · ipe · debian · bookworm
[libcups2]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[libcups2-dev]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[libcupsimage2]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[libcupsimage2-dev]Unknown
Source package: [cups]
Details (4)
- 2.4.2-3+deb12u9 · amd64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · amd64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
- 2.4.2-3+deb12u9 · arm64 · bookworm-security
  Not affected
  dsa · cups · debian · bookworm
[libextractor3]Unknown
Source package: [libextractor]
Details (2)
- 1:1.11-7 · amd64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
- 1:1.11-7 · arm64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
[libextractor-dev]Unknown
Source package: [libextractor]
Details (2)
- 1:1.11-7 · amd64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
- 1:1.11-7 · arm64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
[libextractor-plugin-archive]Unknown
Source package: [libextractor]
Details (2)
- 1:1.11-7 · amd64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
- 1:1.11-7 · arm64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
[libextractor-plugin-exiv2]Unknown
Source package: [libextractor]
Details (2)
- 1:1.11-7 · amd64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12
- 1:1.11-7 · arm64 · bookworm
  Fixed · Fixed: 0.5.12-1
  dsa · libextractor · debian · bookworm; dsa · libextractor · debian · 12

Next results

Observed: Oct 23, 2026, 5:03:40 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]