CVE-2009-1188
Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or…
Does this matter?
Lower severity and a low EPSS score (7.23%). Track it; it rarely justifies an emergency change on its own.
Description
Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 7.23% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-189
- Affected
- poppler/poppler
- Source
- secalert@redhat.com
References
- http://bugs.gentoo.org/show_bug.cgi?id=263028#c16Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html
- http://poppler.freedesktop.org/releases.html
- http://secunia.com/advisories/34746
- http://secunia.com/advisories/35064
- http://secunia.com/advisories/35618
- http://secunia.com/advisories/37028
- http://secunia.com/advisories/37037
- http://secunia.com/advisories/37043
- http://secunia.com/advisories/37053
- http://secunia.com/advisories/37077
- http://secunia.com/advisories/37079
- http://secunia.com/advisories/39327
- http://secunia.com/advisories/39938
- http://wiki.rpath.com/Advisories:rPSA-2009-0059
- http://www.debian.org/security/2010/dsa-2028
- http://www.debian.org/security/2010/dsa-2050
- http://www.kb.cert.org/vuls/id/196617US Government Resource
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:087
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:175
- http://www.redhat.com/support/errata/RHSA-2009-0480.html
- http://www.securityfocus.com/archive/1/502761/100/0/threaded
- http://www.securityfocus.com/bid/34568
- http://www.vupen.com/english/advisories/2009/1076
- http://www.vupen.com/english/advisories/2009/2928
- http://www.vupen.com/english/advisories/2010/0802
- http://www.vupen.com/english/advisories/2010/1040
- http://www.vupen.com/english/advisories/2010/1220
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.