CVE catalog
CVE-2007-4033
t1lib - arbitrary code execution
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 18.66% · Oct 25, 2026
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3. t1lib font filename string overflow Not vulnerable. Versions of PHP packages as shipped with current Red Hat products are not linked with t1lib.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | t1lib | 3.1 | 5.0.2-3 | vulnerable |
| Debian | t1lib | 3.1 | 5.0.2-3sarge1 | fixed |
| Debian | t1lib | 4.0 | 5.1.0-2 | vulnerable |
| Debian | t1lib | 4.0 | 5.1.0-2etch1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | t1lib | deb | 3.1 | 5.0.2-3sarge1 | Not reported | DSA-1390-1 | Not reported |
| Debian | t1lib | deb | 4.0 | 5.1.0-2etch1 | Not reported | DSA-1390-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: