CVE-2007-3387

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

Published: 2007-07-30 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2007-3387 is rated Moderate Risk (55.2/100): CVSS Medium severity, with high exploitation likelihood (EPSS 8.57%, 94th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2007-3387

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 25.21% 8.57% -16.64%
2 2026-06-08 21.43% 25.21% +3.78%
3 2026-06-07 — 21.43% —

Full EPSS history (25 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2007-3387

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.8 2.0 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.6 6.4 [email protected]

Weakness enumeration for CVE-2007-3387

OS Trackers for CVE-2007-3387

vendor priority summary link
debian unimportant CVE-2007-3387 unimportant priority: Debian including 5 source packages (cups, ipe, libextractor, poppler, xpdf), 25 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 25. https://security-tracker.debian.org/tracker/CVE-2007-3387
gentoo normal CVE-2007-3387: 4 GLSA(s) (200709-12, 200709-17, 200710-08, 200710-20), 8 atom(s) (app-office/koffice, app-office/kword, …); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2007-3387
redhat high — https://access.redhat.com/security/cve/CVE-2007-3387
suse medium CVE-2007-3387 severity moderate: SUSE including 47 source package names (cups-1.3.9-8.30.1, cups-1.3.9-8.44.1, …), 47 product×package rows across 10 product lines (SUSE Linux Enterprise Module for Legacy 12, SUSE Linux Enterprise Server 11 SP1, … (10 product lines)): Fixed 43, Known Not Affected 4. https://www.suse.com/security/cve/CVE-2007-3387/
ubuntu medium CVE-2007-3387 medium priority: Ubuntu including 4 source packages (kdegraphics, koffice, poppler, xpdf), 36 status rows across 9 suites (dapper, edgy, feisty, gutsy, hardy, intrepid, jaunty, karmic, upstream): released 21, not-affected 8, needs-triage 4, ignored 3. https://ubuntu.com/security/CVE-2007-3387

Affected software / configurations for CVE-2007-3387

Vendor Product Version Raw CPE
apple cups <= 1.3.11 cpe:2.3:a:apple:cups:*:*:*:*:*:*:*:*
freedesktop poppler < 0.5.91 cpe:2.3:a:freedesktop:poppler:*:*:*:*:*:*:*:*
gpdf_project gpdf < 2.8.2 cpe:2.3:a:gpdf_project:gpdf:*:*:*:*:*:*:*:*
xpdfreader xpdf 3.02 cpe:2.3:a:xpdfreader:xpdf:3.02:*:*:*:*:*:*:*
debian debian_linux 3.1 cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
debian debian_linux 4.0 cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
canonical ubuntu_linux 6.06 cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
canonical ubuntu_linux 6.10 cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*
canonical ubuntu_linux 7.04 cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*

References for CVE-2007-3387

URL Tags
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl1.patch Broken Link
ftp://patches.sgi.com/support/free/security/advisories/20070801-01-P.asc Broken Link
http://bugs.gentoo.org/show_bug.cgi?id=187139 Issue Tracking Third Party Advisory
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=248194 Issue Tracking Third Party Advisory
http://osvdb.org/40127 Broken Link
http://secunia.com/advisories/26188 Third Party Advisory
http://secunia.com/advisories/26251 Third Party Advisory
http://secunia.com/advisories/26254 Third Party Advisory
http://secunia.com/advisories/26255 Third Party Advisory
http://secunia.com/advisories/26257 Third Party Advisory
http://secunia.com/advisories/26278 Third Party Advisory
http://secunia.com/advisories/26281 Third Party Advisory
http://secunia.com/advisories/26283 Third Party Advisory
http://secunia.com/advisories/26292 Third Party Advisory
http://secunia.com/advisories/26293 Third Party Advisory
http://secunia.com/advisories/26297 Third Party Advisory
http://secunia.com/advisories/26307 Third Party Advisory
http://secunia.com/advisories/26318 Third Party Advisory
http://secunia.com/advisories/26325 Third Party Advisory
http://secunia.com/advisories/26342 Third Party Advisory
http://secunia.com/advisories/26343 Third Party Advisory
http://secunia.com/advisories/26358 Third Party Advisory
http://secunia.com/advisories/26365 Third Party Advisory
http://secunia.com/advisories/26370 Third Party Advisory
http://secunia.com/advisories/26395 Third Party Advisory
http://secunia.com/advisories/26403 Third Party Advisory
http://secunia.com/advisories/26405 Third Party Advisory
http://secunia.com/advisories/26407 Third Party Advisory
http://secunia.com/advisories/26410 Third Party Advisory
http://secunia.com/advisories/26413 Third Party Advisory
http://secunia.com/advisories/26425 Third Party Advisory
http://secunia.com/advisories/26432 Third Party Advisory
http://secunia.com/advisories/26436 Third Party Advisory
http://secunia.com/advisories/26467 Third Party Advisory
http://secunia.com/advisories/26468 Third Party Advisory
http://secunia.com/advisories/26470 Third Party Advisory
http://secunia.com/advisories/26514 Third Party Advisory
http://secunia.com/advisories/26607 Third Party Advisory
http://secunia.com/advisories/26627 Third Party Advisory
http://secunia.com/advisories/26862 Third Party Advisory
http://secunia.com/advisories/26982 Third Party Advisory
http://secunia.com/advisories/27156 Third Party Advisory
http://secunia.com/advisories/27281 Third Party Advisory
http://secunia.com/advisories/27308 Third Party Advisory
http://secunia.com/advisories/27637 Third Party Advisory
http://secunia.com/advisories/30168 Third Party Advisory
http://security.gentoo.org/glsa/glsa-200709-12.xml Third Party Advisory
http://security.gentoo.org/glsa/glsa-200709-17.xml Third Party Advisory
http://security.gentoo.org/glsa/glsa-200710-20.xml Third Party Advisory
http://security.gentoo.org/glsa/glsa-200711-34.xml Third Party Advisory
http://security.gentoo.org/glsa/glsa-200805-13.xml Third Party Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.761882 Third Party Advisory
http://sourceforge.net/project/shownotes.php?release_id=535497 Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2007-401.htm Third Party Advisory
http://www.debian.org/security/2007/dsa-1347 Third Party Advisory
http://www.debian.org/security/2007/dsa-1348 Third Party Advisory
http://www.debian.org/security/2007/dsa-1349 Third Party Advisory
http://www.debian.org/security/2007/dsa-1350 Third Party Advisory
http://www.debian.org/security/2007/dsa-1352 Third Party Advisory
http://www.debian.org/security/2007/dsa-1354 Third Party Advisory
http://www.debian.org/security/2007/dsa-1355 Third Party Advisory
http://www.debian.org/security/2007/dsa-1357 Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-200710-08.xml Third Party Advisory
http://www.kde.org/info/security/advisory-20070730-1.txt Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:158 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:159 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:160 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:161 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:162 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:163 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:164 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:165 Third Party Advisory
http://www.novell.com/linux/security/advisories/2007_15_sr.html Broken Link
http://www.novell.com/linux/security/advisories/2007_16_sr.html Broken Link
http://www.redhat.com/support/errata/RHSA-2007-0720.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2007-0729.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2007-0730.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2007-0731.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2007-0732.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2007-0735.html Third Party Advisory
http://www.securityfocus.com/archive/1/476508/100/0/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/476519/30/5400/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/archive/1/476765/30/5340/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/25124 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1018473 Third Party Advisory VDB Entry
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.423670 Third Party Advisory
http://www.ubuntu.com/usn/usn-496-1 Third Party Advisory
http://www.ubuntu.com/usn/usn-496-2 Third Party Advisory
http://www.vupen.com/english/advisories/2007/2704 Permissions Required Third Party Advisory
http://www.vupen.com/english/advisories/2007/2705 Permissions Required Third Party Advisory
https://issues.foresightlinux.org/browse/FL-471 Broken Link
https://issues.rpath.com/browse/RPL-1596 Broken Link
https://issues.rpath.com/browse/RPL-1604 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11149 Third Party Advisory
cvelogic Threat Intelligence