Vulnerability in Foolabs Xpdf
CVE-2009-3608
Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.102 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.102 · newest: 0.102 · change: 0.000
Affected products
- Foolabs Xpdf — versions 3.02pl1, 3.02pl2, 3.02pl3
- Glyph And Cog Pdftops
- Glyphandcog Xpdfreader — versions 3.00, 3.01, 3.02
- GNOME Gpdf
- KDE Kpdf
- Poppler — versions 0.1, 0.1.1, 0.1.2
- Tetex
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secunia.com/advisories/39938 (third-party-advisory)
- rhn.redhat.com/errata/RHSA-2009-1504.html (vendor-advisory)
- www.debian.org/security/2009/dsa-1941 (vendor-advisory)
- www.mandriva.com/security/advisories (vendor-advisory)
- bugzilla.redhat.com/show_bug.cgi (Patch)
- www.openwall.com/lists/oss-security/2009/12/01/6 (mailing-list)
- secunia.com/advisories/37028 (Vendor Advisory, third-party-advisory)
- lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html (vendor-advisory)
- www.redhat.com/archives/fedora-package-announce/2009-October/msg00750.html (vendor-advisory)
- poppler.freedesktop.org/ (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2009-3608?
- CVE-2009-3608 is a vulnerability in Foolabs Xpdf, classified under CWE-189. Published 2009-10-21.
- Is CVE-2009-3608 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.