Published: 21/10/2009 Updated: 07/11/2023

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x prior to 3.02pl4 and Poppler prior to 0.12.1 might allow remote malicious users to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188.

Vulnerable Product	Search on Vulmon	Subscribe to Product
poppler poppler 0.7.3
poppler poppler 0.3.2
poppler poppler 0.10.3
poppler poppler 0.4.0
poppler poppler 0.9.3
poppler poppler 0.10.1
poppler poppler 0.10.0
poppler poppler 0.10.7
poppler poppler 0.7.1
poppler poppler 0.6.1
poppler poppler 0.3.1
poppler poppler 0.11.3
poppler poppler 0.10.6
foolabs xpdf 3.02pl3
poppler poppler 0.5.2
poppler poppler 0.6.0
poppler poppler 0.3.3
poppler poppler 0.4.2
poppler poppler 0.10.4
poppler poppler 0.9.2
poppler poppler 0.6.4
poppler poppler 0.1.2
poppler poppler 0.8.0
poppler poppler 0.11.2
poppler poppler 0.8.3
poppler poppler 0.7.0
poppler poppler 0.7.2
poppler poppler 0.5.0
poppler poppler 0.8.6
poppler poppler 0.5.9
poppler poppler 0.6.3
poppler poppler 0.2.0
poppler poppler 0.8.4
poppler poppler 0.5.4
foolabs xpdf 3.02pl1
poppler poppler 0.1.1
poppler poppler 0.9.0
poppler poppler 0.4.1
poppler poppler 0.5.3
poppler poppler 0.4.4
poppler poppler 0.8.7
poppler poppler 0.9.1
poppler poppler 0.3.0
poppler poppler 0.11.0
poppler poppler 0.1
poppler poppler 0.6.2
foolabs xpdf 3.02pl2
poppler poppler 0.10.2
poppler poppler 0.4.3
poppler poppler 0.8.1
poppler poppler 0.5.1
poppler poppler
poppler poppler 0.8.2
poppler poppler 0.11.1
poppler poppler 0.10.5
glyphandcog xpdfreader 3.00
glyphandcog xpdfreader 3.01
glyphandcog xpdfreader 3.02

Debian Bug report logs - #551287 xpdf: integer overflow and null ptr dereference vulnerabilities Package: xpdf; Maintainer for xpdf is Debian QA Group <packages@qadebianorg>; Source for xpdf is src:xpdf (PTS, buildd, popcon) Reported by: Michael Gilbert <michaelsgilbert@gmailcom> Date: Fri, 16 Oct 2009 21:42:02 ...

USN-850-1 fixed vulnerabilities in poppler This update provides the corresponding updates for Ubuntu 910 ...

It was discovered that poppler contained multiple security issues when parsing malformed PDF documents If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program ...

Several local vulnerabilities have been discovered in KPDF, a PDF viewer for KDE, which allow the execution of arbitrary code or denial of service if a user is tricked into opening a crafted PDF document For the stable distribution (lenny), these problems have been fixed in version 4:359-3+lenny3 The unstable distribution (sid) no longer contai ...

Several vulnerabilities have been identified in xpdf, a suite of tools for viewing and converting Portable Document Format (PDF) files The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1188 and CVE-2009-3603 Integer overflow in SplashBitmap::SplashBitmap which might allow remote attackers to exec ...

CWE-189 http://securitytracker.com/id?1023029 http://poppler.freedesktop.org/http://www.securityfocus.com/bid/36703 http://secunia.com/advisories/37034 http://www.vupen.com/english/advisories/2009/2924 http://secunia.com/advisories/37054 https://bugzilla.redhat.com/show_bug.cgi?id=526915 ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl4.patch https://rhn.redhat.com/errata/RHSA-2009-1504.html http://www.vupen.com/english/advisories/2009/2925 http://secunia.com/advisories/37053 http://www.mandriva.com/security/advisories?name=MDVSA-2009:287 https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00784.html https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00750.html http://secunia.com/advisories/37159 http://www.ubuntu.com/usn/USN-850-1 http://secunia.com/advisories/37114 http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html http://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1 http://www.ubuntu.com/usn/USN-850-3 http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.html http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.html http://secunia.com/advisories/39327 http://www.vupen.com/english/advisories/2010/0802 http://www.debian.org/security/2010/dsa-2028 http://www.mandriva.com/security/advisories?name=MDVSA-2010:087 http://www.vupen.com/english/advisories/2010/1040 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1 http://secunia.com/advisories/39938 http://www.debian.org/security/2010/dsa-2050 http://www.vupen.com/english/advisories/2010/1220 http://www.mandriva.com/security/advisories?name=MDVSA-2011:175 https://exchange.xforce.ibmcloud.com/vulnerabilities/53793 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9671 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=551287 https://nvd.nist.gov https://usn.ubuntu.com/850-3/

CVE-2009-3603

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect