dbcve.org
Debian LinuxOperating system · Debian

CVE-2004-0888

HIGH · 10.0 CVSS v2.0 Published 2005-01-27
Patch available
A vendor patch is available. No clean upgrade release — apply the published patch.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis

A detailed technical summary for this CVE is being prepared.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Debian LinuxOperating system
Affected:= 3.0
LinuxOperating system
Affected:all versions
Enterprise LinuxOperating system
Affected:= 2.1= 3.0
Enterprise Linux DesktopOperating system
Affected:= 3.0
Fedora CoreOperating system
Affected:= core_2.0
Linux Advanced WorkstationOperating system
Affected:= 2.1
Ubuntu LinuxOperating system
Affected:= 4.1
CupsApplication
Affected:= 1.0.4= 1.0.4_8= 1.1.1= 1.1.4= 1.1.4_2= 1.1.4_3= 1.1.4_5= 1.1.6= 1.1.7= 1.1.10= 1.1.12= 1.1.13

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Patch available Apply the vendor patch
Vendor patch www.redhat.com →
Recommended fix Moderate confidence

Upgrade to distribution-provided security updates (xpdf 3.0x or later, CUPS 1.1.20+ or vendor-patched versions)

  1. 1. Identify all installed packages that incorporate xpdf code (xpdf, cups, gpdf, kdegraphics) using your system's package manager
  2. 2. Check current versions of these packages: on Debian/Ubuntu use 'dpkg -l | grep -E "xpdf|cups|gpdf|kdegraphics"', on RHEL/Fedora use 'rpm -qa | grep -E "xpdf|cups"'
  3. 3. Upgrade each affected package to the latest available version from your distribution's vendor repositories
  4. 4. For RHEL/EL systems, apply the vendor patch from RHSA-2004-543: run 'up2date' or 'yum update' to receive security updates
  5. 5. For Debian/Ubuntu, run 'apt-get update && apt-get upgrade' or 'apt-get install <package-name>' for specific packages
  6. 6. After updating, restart any services using the affected software (particularly CUPS daemon: '/etc/init.d/cups restart')
  7. 7. Verify the installed versions no longer contain the vulnerable xpdf code
Caveat Minimal risk; this is a security-only update. Some legacy PDF configurations may need testing after upgrade.

Generated from the published advisory — verify against the referenced sources before acting.

We can apply and verify the patch for your build — typical engagement from $1,950. Get the patch applied

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2004-0888 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2004-0888 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data