The Linux version of xpdf is linked against t1lib, which is vulnerable to multiple vulnerabilities including off by ones, integer overflows and heap corruptions. At least one of those is exploitable and allows arbitrary code to be executed on the target machine when opening a specially crafted pdf file.
cde36b4c326f4058f72f66b8fe4a29b09dd60fc123357793a2b5fddd8074c956