LiveActive security incident?Get immediate response
CVE Record

CVE-2004-0889: Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote at...

Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takehigh

Analyst readout for executives and security teams

Plain-English summary

CVE-2004-0889 is an old xpdf 3.0 vulnerability class where malformed PDF handling can crash software and may allow code execution. The concern is not only xpdf itself, but other software that reused xpdf code, including CUPS. Impact depends on whether legacy PDF-processing or printing components remain installed.

Executive priority

Handle as a legacy exposure cleanup item with high priority where PDF or print services process untrusted files. Business risk is concentrated in forgotten servers and automated document workflows rather than modern fully patched environments.

Technical view

The CVE describes multiple integer overflows in xpdf 3.0 and packages using xpdf code. Remote attackers may trigger denial of service and possible arbitrary code execution. The source bundle does not provide CVSS, CWE, exact fixed versions, or a complete affected-product matrix.

Likely exposure

Exposure is most likely on legacy Unix/Linux systems, print servers, or document-processing workflows running xpdf 3.0 or packages incorporating xpdf code, such as CUPS. Exact exposure requires local package and vendor-advisory mapping because the CVE record lists affected products generically.

Exploitation context

The bundle does not show CISA KEV listing or confirmed active exploitation. Sources describe remote attack potential against PDF-processing code, with denial of service and possible code execution. Treat internet-facing or automated handling of untrusted PDFs as higher risk.

Researcher notes

Evidence is limited to the CVE description and listed advisories. The record separates this from CVE-2004-0888 but does not provide detailed overflow locations, affected downstream versions, or patch identifiers in the supplied bundle.

Mitigation direction

  • Inventory xpdf, CUPS, and packages that embed xpdf-derived code.
  • Review vendor advisories from Mandriva, Gentoo, SUSE, and upstream sources.
  • Apply vendor-provided fixed packages where available.
  • Disable or isolate untrusted PDF processing where patch status is unknown.
  • Prioritize legacy print and document-conversion servers for remediation.

Validation and detection

  • Check installed package names and versions against vendor advisories.
  • Identify services that automatically parse PDFs from users or email.
  • Confirm whether CUPS or related packages include vulnerable xpdf code.
  • Verify patched packages are deployed on all affected systems.
  • Review crash logs for suspicious PDF-processing failures.
Prepared
Confidence
medium
Sources
8

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2004-0889 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
7Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.