VIR Vulnerability Intelligence Relay

CVE-2013-4472

low
Published 2014-04-22 · Modified 2026-05-06
CVSS v3
—
CVSS v2
3.3
VIR risk
3.3

Description

The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2013-4472

OS impact
OSVersionStatusFixed in
debian debianbookwormaffected
debian debianbullseyeaffected
debian debianforkyaffected
debian debiansidaffected
debian debiantrixieaffected

Application impact
VendorProductVersionsFixed
freedesktoppoppler{"endIncluding":"0.24.3"}
freedesktoppoppler0.24.0
freedesktoppoppler0.24.1
freedesktoppoppler0.24.2

References

CWEs

CWE-59

Verify integrity in audit chain (admin only). AS-IS.