CVE-2011-0764
CVE-2011-0764 is a medium-severity vulnerability in T1lib with a CVSS 2.0 base score of 6.8. Its EPSS exploit-prediction score of 13% places it in the 96th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-20.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.8)
- EPSS exploit prediction: 13% (96th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-20
- Affected product: T1lib
- Published:
- Last modified:
Description
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.
Frequently asked questions
- What is CVE-2011-0764?
- t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.
- How severe is CVE-2011-0764?
- CVE-2011-0764 has a CVSS 2.0 base score of 6.8, rated medium severity.
- Is CVE-2011-0764 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 13% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2011-0764?
- CVE-2011-0764 primarily affects T1lib. In total, 64 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2011-0764?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2011-0764 published?
- CVE-2011-0764 was published on 2011-03-31 and last updated on 2026-06-16.
References
- http://rhn.redhat.com/errata/RHSA-2012-1201.html
- http://secunia.com/advisories/43823
- http://secunia.com/advisories/47347
- http://secunia.com/advisories/48985
- http://securityreason.com/securityalert/8171
- http://securitytracker.com/id?1025266
- http://www.foolabs.com/xpdf/download.html
- http://www.kb.cert.org/vuls/id/376500
- http://www.kb.cert.org/vuls/id/MAPG-8ECL8X
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:002
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:144
- http://www.securityfocus.com/archive/1/517205/100/0/threaded
- http://www.securityfocus.com/bid/46941
- http://www.toucan-system.com/advisories/tssa-2011-01.txt
- http://www.ubuntu.com/usn/USN-1316-1
- http://www.vupen.com/english/advisories/2011/0728
- https://exchange.xforce.ibmcloud.com/vulnerabilities/66208
- https://security.gentoo.org/glsa/201701-57
Affected products (64)
- cpe:2.3:a:t1lib:t1lib:*:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.1:alpha:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.2:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.3:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.4:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.5:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.6:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.7:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.8:beta:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.9:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:t1lib:t1lib:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.5a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.7a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.91a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.91b:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.91c:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92b:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92c:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92d:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.92e:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.93a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.93b:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:0.93c:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:1.00a:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:foolabs:xpdf:3.02pl1:*:*:*:*:*:*:*
More vulnerabilities in T1lib
- CVE-2010-2642 — High (CVSS 7.6): Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0,…
- CVE-2007-4033 — High (CVSS 7.5): Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent…
- CVE-2011-5244 — Medium (CVSS 6.8): Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as…
- CVE-2011-0433 — Medium (CVSS 6.8): Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and…
- CVE-2011-1554 — Medium (CVSS 4.3): Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote…
- CVE-2011-1553 — Medium (CVSS 4.3): Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products,…
Other CWE-20 (Improper Input Validation) vulnerabilities
- CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
- CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
- CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…
Browse all CWE-20 (Improper Input Validation) vulnerabilities →