CVE-2010-3702

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-11-05 · updated 2026-06-16
Weakness: CWE-476

Description

The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.

Affected products

cups: through 1.3.11
Canonical Ubuntu Linux: 6.06, 8.04, 9.04, 9.10, 10.04, 10.10
Debian Linux: 5.0, 6.0
Fedoraproject Fedora: 12, 13, 14
poppler: from 0.8.7 through 0.15.1
Opensuse: 11.1, 11.2, 11.3
RedHat Enterprise Linux Desktop: 5.0
RedHat Enterprise Linux Server: 5.0
RedHat Enterprise Linux Workstation: 5.0
SUSE Linux Enterprise Server: 9, 10-sp3, 11, 11-sp1
Xpdf: through 3.01; 3.02, 3.02-pl1, 3.02-pl2, 3.02-pl3, 3.02-pl4

References

Get alerted when CVE-2010-3702 or the next vulnerability affects your stack