CVE-2009-3605 — Integer Overflow or Wraparound in Poppler

CWE-190 — Integer Overflow or Wraparound8 documents7 sources
Severity
6.8MEDIUMNVD
EPSS
4.4%
top 10.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Freedesktop PopplerPoppler
Timeline
PublishedNov 2
Latest updateMay 2

Description

Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/. NOTE: this may overlap CVE-2009-0791.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶Debianfreedesktop/poppler< 0.12.2-1+3
▶NVDpoppler/poppler0.10.5+47

🔴Vulnerability Details

3
GHSA
GHSA-52vw-r24f-727x: Multiple integer overflows in Poppler 0↗2022-05-02
▶
CVEList
CVE-2009-3605: Multiple integer overflows in Poppler 0↗2009-11-02
▶
OSV
CVE-2009-3605: Multiple integer overflows in Poppler 0↗2009-11-02
▶

📋Vendor Advisories

4
Ubuntu
poppler regression↗2009-10-22
▶
Ubuntu
poppler vulnerabilities↗2009-10-21
▶
Red Hat
xpdf: multiple integer overflows↗2009-05-19
▶
Debian
CVE-2009-3605: poppler - Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers ...↗2009
▶
CVE-2009-3605 — Integer Overflow or Wraparound | cvebase