CVEvulnerability
CVE-2009-0800
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-04-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
Affected configurations
• foolabs xpdf 0.5a
• foolabs xpdf 0.7a
• foolabs xpdf 0.91a
• foolabs xpdf 0.91b
• foolabs xpdf 0.91c
• foolabs xpdf 0.92a
• foolabs xpdf 0.92b
• foolabs xpdf 0.92c
• foolabs xpdf 0.92d
• foolabs xpdf 0.92e
• foolabs xpdf 0.93a
• foolabs xpdf 0.93b
• foolabs xpdf 0.93c
• foolabs xpdf 1.00a
• glyphandcog xpdfreader (<= 3.02)
• glyphandcog xpdfreader 0.2
• glyphandcog xpdfreader 0.3
• glyphandcog xpdfreader 0.4
• glyphandcog xpdfreader 0.5
• glyphandcog xpdfreader 0.6
• glyphandcog xpdfreader 0.7
• glyphandcog xpdfreader 0.80
• glyphandcog xpdfreader 0.90
• glyphandcog xpdfreader 0.91
• glyphandcog xpdfreader 0.92
• glyphandcog xpdfreader 0.93
• glyphandcog xpdfreader 1.00
• glyphandcog xpdfreader 1.01
• glyphandcog xpdfreader 2.00
• glyphandcog xpdfreader 2.01
• glyphandcog xpdfreader 2.02
• glyphandcog xpdfreader 2.03
• glyphandcog xpdfreader 3.00
• glyphandcog xpdfreader 3.01
• poppler poppler (<= 0.10.5)
• poppler poppler 0.1
• poppler poppler 0.1.1
• poppler poppler 0.1.2
• poppler poppler 0.2.0
• poppler poppler 0.3.0
• poppler poppler 0.3.1
• poppler poppler 0.3.2
• poppler poppler 0.3.3
• poppler poppler 0.4.0
• poppler poppler 0.4.1
• poppler poppler 0.4.2
• poppler poppler 0.4.3
• poppler poppler 0.4.4
• poppler poppler 0.5.0
• poppler poppler 0.5.1
• poppler poppler 0.5.2
• poppler poppler 0.5.3
• poppler poppler 0.5.4
• poppler poppler 0.5.9
• poppler poppler 0.5.90
• poppler poppler 0.5.91
• poppler poppler 0.6.0
• poppler poppler 0.6.1
• poppler poppler 0.6.2
• poppler poppler 0.6.3
… and 78 more
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html lists.opensuse.org
- http://poppler.freedesktop.org/releases.html poppler.freedesktop.org
- http://rhn.redhat.com/errata/RHSA-2009-0458.html rhn.redhat.com
- http://secunia.com/advisories/34291 Vendor Advisory
- http://secunia.com/advisories/34481 Vendor Advisory
- http://secunia.com/advisories/34746 Vendor Advisory
- http://secunia.com/advisories/34755 Vendor Advisory
- http://secunia.com/advisories/34756 Vendor Advisory
- http://secunia.com/advisories/34852 Vendor Advisory
- http://secunia.com/advisories/34959 Vendor Advisory
- http://secunia.com/advisories/34963 Vendor Advisory
- http://secunia.com/advisories/34991 Vendor Advisory
- http://secunia.com/advisories/35037 Vendor Advisory
- http://secunia.com/advisories/35064 Vendor Advisory
- http://secunia.com/advisories/35065 Vendor Advisory
- http://secunia.com/advisories/35618 Vendor Advisory
- http://secunia.com/advisories/35685 secunia.com
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477 slackware.com
- http://www.debian.org/security/2009/dsa-1790 www.debian.org
- http://www.debian.org/security/2009/dsa-1793 www.debian.org
- http://www.kb.cert.org/vuls/id/196617 US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:101 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:087 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:175 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2009-0429.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0430.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0431.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0480.html www.redhat.com
- http://www.securityfocus.com/bid/34568 www.securityfocus.com
- http://www.securitytracker.com/id?1022073 www.securitytracker.com
- http://www.vupen.com/english/advisories/2009/1065 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1066 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1076 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1077 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1040 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=495887 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11323 oval.cisecurity.org
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00567.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01277.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01291.html www.redhat.com
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html lists.opensuse.org
- http://poppler.freedesktop.org/releases.html poppler.freedesktop.org
- http://rhn.redhat.com/errata/RHSA-2009-0458.html rhn.redhat.com
- http://secunia.com/advisories/34291 Vendor Advisory
- http://secunia.com/advisories/34481 Vendor Advisory
- http://secunia.com/advisories/34746 Vendor Advisory
- http://secunia.com/advisories/34755 Vendor Advisory
- http://secunia.com/advisories/34756 Vendor Advisory
- http://secunia.com/advisories/34852 Vendor Advisory
- http://secunia.com/advisories/34959 Vendor Advisory
- http://secunia.com/advisories/34963 Vendor Advisory
- http://secunia.com/advisories/34991 Vendor Advisory
- http://secunia.com/advisories/35037 Vendor Advisory
- http://secunia.com/advisories/35064 Vendor Advisory
- http://secunia.com/advisories/35065 Vendor Advisory
- http://secunia.com/advisories/35618 Vendor Advisory
- http://secunia.com/advisories/35685 secunia.com
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477 slackware.com
- http://www.debian.org/security/2009/dsa-1790 www.debian.org
- http://www.debian.org/security/2009/dsa-1793 www.debian.org
- http://www.kb.cert.org/vuls/id/196617 US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:101 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:087 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:175 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2009-0429.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0430.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0431.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0480.html www.redhat.com
- http://www.securityfocus.com/bid/34568 www.securityfocus.com
- http://www.securitytracker.com/id?1022073 www.securitytracker.com
- http://www.vupen.com/english/advisories/2009/1065 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1066 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1076 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1077 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1040 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=495887 bugzilla.redhat.com