CVE-2020-24996 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42028): There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. CVE-2020-24999 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42029): There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact. Doesn't look like there's a fix yet.
Note that these vulnerabilities does not affect the main xpdf binary, so if someone wants to get rid of them before upstream fix is available, just build xpdf without USE="utils".
CVE-2020-24996 is a duplicate of CVE-2019-17064 which is already fixed in Gentoo starting from xpdf-4.02-r2 (commit 6ab1a068d867bd08ed5377a7b5a8d9e3ec046b18): https://forum.xpdfreader.com/viewtopic.php?f=3&t=42028#p43071
Package list is empty or all packages have requested keywords.
Allegedly CVE-2020-24999 will be fixed in xpdf-5
