CVEvulnerability
CVE-2009-1182
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-04-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-119
Description
Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
Affected configurations
• foolabs xpdf 0.5a
• foolabs xpdf 0.7a
• foolabs xpdf 0.91a
• foolabs xpdf 0.91b
• foolabs xpdf 0.91c
• foolabs xpdf 0.92a
• foolabs xpdf 0.92b
• foolabs xpdf 0.92c
• foolabs xpdf 0.92d
• foolabs xpdf 0.92e
• foolabs xpdf 0.93a
• foolabs xpdf 0.93b
• foolabs xpdf 0.93c
• foolabs xpdf 1.00a
• glyphandcog xpdfreader (<= 3.02)
• glyphandcog xpdfreader 0.2
• glyphandcog xpdfreader 0.3
• glyphandcog xpdfreader 0.4
• glyphandcog xpdfreader 0.5
• glyphandcog xpdfreader 0.6
• glyphandcog xpdfreader 0.7
• glyphandcog xpdfreader 0.80
• glyphandcog xpdfreader 0.90
• glyphandcog xpdfreader 0.91
• glyphandcog xpdfreader 0.92
• glyphandcog xpdfreader 0.93
• glyphandcog xpdfreader 1.00
• glyphandcog xpdfreader 1.01
• glyphandcog xpdfreader 2.00
• glyphandcog xpdfreader 2.01
• glyphandcog xpdfreader 2.02
• glyphandcog xpdfreader 2.03
• glyphandcog xpdfreader 3.00
• glyphandcog xpdfreader 3.01
• poppler poppler (<= 0.10.5)
• poppler poppler 0.1
• poppler poppler 0.1.1
• poppler poppler 0.1.2
• poppler poppler 0.2.0
• poppler poppler 0.3.0
• poppler poppler 0.3.1
• poppler poppler 0.3.2
• poppler poppler 0.3.3
• poppler poppler 0.4.0
• poppler poppler 0.4.1
• poppler poppler 0.4.2
• poppler poppler 0.4.3
• poppler poppler 0.4.4
• poppler poppler 0.5.0
• poppler poppler 0.5.1
• poppler poppler 0.5.2
• poppler poppler 0.5.3
• poppler poppler 0.5.4
• poppler poppler 0.5.9
• poppler poppler 0.5.90
• poppler poppler 0.5.91
• poppler poppler 0.6.0
• poppler poppler 0.6.1
• poppler poppler 0.6.2
• poppler poppler 0.6.3
… and 78 more
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html lists.opensuse.org
- http://poppler.freedesktop.org/releases.html poppler.freedesktop.org
- http://rhn.redhat.com/errata/RHSA-2009-0458.html Vendor Advisory
- http://secunia.com/advisories/34291 Vendor Advisory
- http://secunia.com/advisories/34481 Vendor Advisory
- http://secunia.com/advisories/34746 Vendor Advisory
- http://secunia.com/advisories/34755 Vendor Advisory
- http://secunia.com/advisories/34756 Vendor Advisory
- http://secunia.com/advisories/34852 Vendor Advisory
- http://secunia.com/advisories/34959 Vendor Advisory
- http://secunia.com/advisories/34963 Vendor Advisory
- http://secunia.com/advisories/34991 Vendor Advisory
- http://secunia.com/advisories/35037 Vendor Advisory
- http://secunia.com/advisories/35064 Vendor Advisory
- http://secunia.com/advisories/35065 Vendor Advisory
- http://secunia.com/advisories/35618 Vendor Advisory
- http://secunia.com/advisories/35685 Vendor Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477 slackware.com
- http://www.debian.org/security/2009/dsa-1790 www.debian.org
- http://www.debian.org/security/2009/dsa-1793 www.debian.org
- http://www.kb.cert.org/vuls/id/196617 US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:101 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:087 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:175 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2009-0429.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0430.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0431.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0480.html www.redhat.com
- http://www.securityfocus.com/bid/34568 www.securityfocus.com
- http://www.securitytracker.com/id?1022073 www.securitytracker.com
- http://www.vupen.com/english/advisories/2009/1065 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1066 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1076 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1077 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1040 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=495896 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10735 oval.cisecurity.org
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00567.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01277.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01291.html www.redhat.com
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html lists.opensuse.org
- http://poppler.freedesktop.org/releases.html poppler.freedesktop.org
- http://rhn.redhat.com/errata/RHSA-2009-0458.html Vendor Advisory
- http://secunia.com/advisories/34291 Vendor Advisory
- http://secunia.com/advisories/34481 Vendor Advisory
- http://secunia.com/advisories/34746 Vendor Advisory
- http://secunia.com/advisories/34755 Vendor Advisory
- http://secunia.com/advisories/34756 Vendor Advisory
- http://secunia.com/advisories/34852 Vendor Advisory
- http://secunia.com/advisories/34959 Vendor Advisory
- http://secunia.com/advisories/34963 Vendor Advisory
- http://secunia.com/advisories/34991 Vendor Advisory
- http://secunia.com/advisories/35037 Vendor Advisory
- http://secunia.com/advisories/35064 Vendor Advisory
- http://secunia.com/advisories/35065 Vendor Advisory
- http://secunia.com/advisories/35618 Vendor Advisory
- http://secunia.com/advisories/35685 Vendor Advisory
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477 slackware.com
- http://www.debian.org/security/2009/dsa-1790 www.debian.org
- http://www.debian.org/security/2009/dsa-1793 www.debian.org
- http://www.kb.cert.org/vuls/id/196617 US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:101 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:087 www.mandriva.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:175 www.mandriva.com
- http://www.redhat.com/support/errata/RHSA-2009-0429.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0430.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0431.html www.redhat.com
- http://www.redhat.com/support/errata/RHSA-2009-0480.html www.redhat.com
- http://www.securityfocus.com/bid/34568 www.securityfocus.com
- http://www.securitytracker.com/id?1022073 www.securitytracker.com
- http://www.vupen.com/english/advisories/2009/1065 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1066 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1076 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1077 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1040 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=495896 bugzilla.redhat.com