Vulnerability Intelligence Report
CVE-2009-3609
Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.
No Active Exploit Signals
CVSS Base Score
4.3
MEDIUM
EPSS Probability:4.48%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| foolabs | xpdf | 3.02pl1, 3.02pl2, 3.02pl3 |
| glyphandcog | xpdfreader | 3.00, 3.01, 3.02 |
| poppler | poppler | 0.1, 0.1.1, 0.1.2, 0.2.0, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.9, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.6, 0.8.7, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6, 0.10.7, 0.11.0, 0.11.1, 0.11.2, 0.11.3 |
| glyph_and_cog | pdftops | all |
| gnome | gpdf | all |
| kde | kpdf | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.483%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2009-10-09T00:00:00 |
| Published | 2009-10-21T17:00:00 |
| Patch Date | 2009-10-15 |
| Last Updated | 2024-08-07T06:31:10 |
Community Chatter & Buzz