5
CVSSv2

CVE-2009-1188

Published: 23/04/2009 Updated: 13/02/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x prior to 3.02pl4 and Poppler prior to 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote malicious users to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

Vulnerable Product Search on Vulmon Subscribe to Product

poppler poppler 0.7.3

poppler poppler 0.3.2

poppler poppler 0.10.3

poppler poppler 0.4.0

poppler poppler 0.8.5

poppler poppler 0.9.3

poppler poppler 0.10.1

poppler poppler 0.10.0

poppler poppler 0.7.1

poppler poppler 0.6.1

poppler poppler 0.3.1

poppler poppler 0.5.2

poppler poppler 0.5.91

poppler poppler 0.6.0

poppler poppler 0.3.3

poppler poppler 0.4.2

poppler poppler 0.10.4

poppler poppler 0.9.2

poppler poppler 0.6.4

poppler poppler 0.1.2

poppler poppler 0.8.0

poppler poppler 0.8.3

poppler poppler 0.7.0

poppler poppler 0.7.2

poppler poppler 0.5.0

poppler poppler 0.8.6

poppler poppler 0.5.9

poppler poppler 0.5.90

poppler poppler 0.6.3

poppler poppler 0.2.0

poppler poppler 0.8.4

poppler poppler 0.5.4

poppler poppler 0.1.1

poppler poppler 0.9.0

poppler poppler 0.4.1

poppler poppler 0.5.3

poppler poppler

poppler poppler 0.4.4

poppler poppler 0.8.7

poppler poppler 0.9.1

poppler poppler 0.3.0

poppler poppler 0.1

poppler poppler 0.6.2

poppler poppler 0.10.2

poppler poppler 0.4.3

poppler poppler 0.8.1

poppler poppler 0.5.1

poppler poppler 0.8.2

Vendor Advisories

Synopsis Important: poppler security update Type/Severity Security Advisory: Important Topic Updated poppler packages that fix multiple security issues are nowavailable for Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team ...
Will Dormann, Alin Rad Pop, Braden Thomas, and Drew Yao discovered that poppler contained multiple security issues in its JBIG2 decoder If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program ...
Debian Bug report logs - #524806 poppler: multiple vulnerabilities Package: poppler; Maintainer for poppler is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> Date: Mon, 20 Apr 2009 02:06:01 UTC Severity: grave T ...
Debian Bug report logs - #551287 xpdf: integer overflow and null ptr dereference vulnerabilities Package: xpdf; Maintainer for xpdf is Debian QA Group <packages@qadebianorg>; Source for xpdf is src:xpdf (PTS, buildd, popcon) Reported by: Michael Gilbert <michaelsgilbert@gmailcom> Date: Fri, 16 Oct 2009 21:42:02 ...
Several local vulnerabilities have been discovered in KPDF, a PDF viewer for KDE, which allow the execution of arbitrary code or denial of service if a user is tricked into opening a crafted PDF document For the stable distribution (lenny), these problems have been fixed in version 4:359-3+lenny3 The unstable distribution (sid) no longer contai ...
Several vulnerabilities have been identified in xpdf, a suite of tools for viewing and converting Portable Document Format (PDF) files The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1188 and CVE-2009-3603 Integer overflow in SplashBitmap::SplashBitmap which might allow remote attackers to exec ...

References

CWE-189http://bugs.gentoo.org/show_bug.cgi?id=263028#c16https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/361875http://poppler.freedesktop.org/releases.htmlhttp://secunia.com/advisories/34746http://www.vupen.com/english/advisories/2009/1076http://www.securityfocus.com/bid/34568http://wiki.rpath.com/Advisories:rPSA-2009-0059http://www.kb.cert.org/vuls/id/196617http://www.redhat.com/support/errata/RHSA-2009-0480.htmlhttp://secunia.com/advisories/35064http://secunia.com/advisories/35618https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01277.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-June/msg01291.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-July/msg00567.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1503.htmlhttp://secunia.com/advisories/37077http://secunia.com/advisories/37079http://secunia.com/advisories/37043https://bugzilla.redhat.com/show_bug.cgi?id=495907https://rhn.redhat.com/errata/RHSA-2009-1501.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=526915http://www.vupen.com/english/advisories/2009/2928https://rhn.redhat.com/errata/RHSA-2009-1512.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1502.htmlhttp://secunia.com/advisories/37037http://secunia.com/advisories/37028http://secunia.com/advisories/37053http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.htmlhttp://www.vupen.com/english/advisories/2010/0802http://www.debian.org/security/2010/dsa-2028http://secunia.com/advisories/39327http://www.vupen.com/english/advisories/2010/1040http://www.mandriva.com/security/advisories?name=MDVSA-2010:087http://secunia.com/advisories/39938http://www.debian.org/security/2010/dsa-2050http://www.vupen.com/english/advisories/2010/1220http://www.mandriva.com/security/advisories?name=MDVSA-2011:175https://exchange.xforce.ibmcloud.com/vulnerabilities/50185https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9957http://www.securityfocus.com/archive/1/502761/100/0/threadedhttps://access.redhat.com/errata/RHSA-2009:0480https://usn.ubuntu.com/759-1/https://nvd.nist.govhttps://www.kb.cert.org/vuls/id/196617