CVE-2007-4033
NoneCVSS
—
EPSS
18.7%
Published
Jul 27, 2007
CISA due date
—
The record
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:3.1 | t1lib | 0 | 5.0.2-3sarge1 |
| Debian:4.0 | t1lib | 0 | 5.1.0-2etch1 |
| Red Hat:enterprise_linux:2.1::as | xpdf | 0 | 1:0.92-19.el2 |
| Red Hat:enterprise_linux:2.1::aw | xpdf | 0 | 1:0.92-19.el2 |
| Red Hat:enterprise_linux:2.1::es | xpdf | 0 | 1:0.92-19.el2 |
| Red Hat:enterprise_linux:2.1::ws | xpdf | 0 | 1:0.92-19.el2 |
| Red Hat:enterprise_linux:3::as | xpdf | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:3::as | xpdf-debuginfo | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:3::desktop | xpdf | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:3::desktop | xpdf-debuginfo | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:3::es | xpdf | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:3::es | xpdf-debuginfo | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:3::ws | xpdf | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:3::ws | xpdf-debuginfo | 0 | 1:2.02-11.el3 |
| Red Hat:enterprise_linux:4::as | tetex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::as | tetex-afm | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::as | tetex-debuginfo | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::as | tetex-doc | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::as | tetex-dvips | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::as | tetex-fonts | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::as | tetex-latex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::as | tetex-xdvi | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex-afm | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex-debuginfo | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex-doc | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex-dvips | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex-fonts | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex-latex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::desktop | tetex-xdvi | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex-afm | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex-debuginfo | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex-doc | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex-dvips | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex-fonts | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex-latex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::es | tetex-xdvi | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex-afm | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex-debuginfo | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex-doc | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex-dvips | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex-fonts | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex-latex | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:4::ws | tetex-xdvi | 0 | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat:enterprise_linux:5::client | tetex | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::client | tetex-afm | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::client | tetex-debuginfo | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::client | tetex-doc | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::client | tetex-dvips | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::client | tetex-fonts | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::client | tetex-latex | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::client | tetex-xdvi | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex-afm | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex-debuginfo | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex-doc | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex-dvips | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex-fonts | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex-latex | 0 | 0:3.0-33.2.el5_1.2 |
| Red Hat:enterprise_linux:5::server | tetex-xdvi | 0 | 0:3.0-33.2.el5_1.2 |
Related vulnerabilities
- CVE-2011-1552 t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads… Also affects tetex
- CVE-2011-0764 t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses… Also affects tetex
- CVE-2010-2642 Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince… Also affects tetex
- CVE-2009-3608 Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before… Also affects tetex
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-119