Read the docs
TI-2006-01203 Aliases CVE-2006-1244GHSA-2hp4-p7vf-34wc

Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various…

Priority LOW 38Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature.

Why it matters now

EPSS 0.02189 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:gnome:gpdf:2.8.2:*:*:*:*:*:*:*2.8.2VulnerableGNOME
cpe:2.3:a:libextractor:libextractor:0.3.6:*:*:*:*:*:*:*0.3.6VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.3.7:*:*:*:*:*:*:*0.3.7VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.3.8:*:*:*:*:*:*:*0.3.8VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.3.9:*:*:*:*:*:*:*0.3.9VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.3.11:*:*:*:*:*:*:*0.3.11VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.4:*:*:*:*:*:*:*0.4VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.4.1:*:*:*:*:*:*:*0.4.1VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.4.2:*:*:*:*:*:*:*0.4.2VulnerableLibextractor
cpe:2.3:a:libextractor:libextractor:0.5:*:*:*:*:*:*:*0.5VulnerableLibextractor
  • cpe:2.3:a:gnome:gpdf:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·GNOME
  • cpe:2.3:a:libextractor:libextractor:0.3.6:*:*:*:*:*:*:* Versions 0.3.6 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.3.7:*:*:*:*:*:*:* Versions 0.3.7 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.3.8:*:*:*:*:*:*:* Versions 0.3.8 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.3.9:*:*:*:*:*:*:* Versions 0.3.9 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.3.11:*:*:*:*:*:*:* Versions 0.3.11 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.4.2:*:*:*:*:*:*:* Versions 0.4.2 Vulnerable ·Libextractor
  • cpe:2.3:a:libextractor:libextractor:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Libextractor
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:xpdf:xpdf:0.90:*:*:*:*:*:*:*0.90VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:0.91:*:*:*:*:*:*:*0.91VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:0.92:*:*:*:*:*:*:*0.92VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:0.93:*:*:*:*:*:*:*0.93VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:1.0:*:*:*:*:*:*:*1.0VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:1.0a:*:*:*:*:*:*:*1.0aVulnerableXpdf
cpe:2.3:a:xpdf:xpdf:1.1:*:*:*:*:*:*:*1.1VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:2.0:*:*:*:*:*:*:*2.0VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:2.1:*:*:*:*:*:*:*2.1VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:2.2:*:*:*:*:*:*:*2.2VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:2.3:*:*:*:*:*:*:*2.3VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:3.0:*:*:*:*:*:*:*3.0VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:3.0.1_pl1:*:*:*:*:*:*:*3.0.1_pl1VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:3.0_pl2:*:*:*:*:*:*:*3.0_pl2VulnerableXpdf
cpe:2.3:a:xpdf:xpdf:3.0_pl3:*:*:*:*:*:*:*3.0_pl3VulnerableXpdf
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:alpha:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:amd64:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:arm:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:hppa:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:m68k:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:mips:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:ppc:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:s-390:*:*:*:*:*3.1VulnerableDebian
cpe:2.3:o:debian:debian_linux:3.1:*:sparc:*:*:*:*:*3.1VulnerableDebian
  • cpe:2.3:a:xpdf:xpdf:0.90:*:*:*:*:*:*:* Versions 0.90 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:0.91:*:*:*:*:*:*:* Versions 0.91 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:0.92:*:*:*:*:*:*:* Versions 0.92 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:0.93:*:*:*:*:*:*:* Versions 0.93 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:1.0a:*:*:*:*:*:*:* Versions 1.0a Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:3.0.1_pl1:*:*:*:*:*:*:* Versions 3.0.1_pl1 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:3.0_pl2:*:*:*:*:*:*:* Versions 3.0_pl2 Vulnerable ·Xpdf
  • cpe:2.3:a:xpdf:xpdf:3.0_pl3:*:*:*:*:*:*:* Versions 3.0_pl3 Vulnerable ·Xpdf
  • cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:alpha:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:amd64:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:arm:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:hppa:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:ia-32:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:ia-64:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:m68k:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:mips:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:mipsel:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:ppc:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:s-390:*:*:*:*:* Versions 3.1 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:3.1:*:sparc:*:*:*:*:* Versions 3.1 Vulnerable ·Debian

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-1244
  2. 2026-10-03 Alias added: GHSA-2hp4-p7vf-34wc

References

Patch 7

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences