CVE-2009-3938 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Poppler

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents7 sources
Severity
6.8MEDIUMNVD
EPSS
3.4%
top 12.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Freedesktop PopplerPoppler
Timeline
PublishedNov 13
Latest updateMay 2

Description

Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶Debianfreedesktop/poppler< 0.12.2-2.1+3
▶NVDpoppler/poppler0.10.6, 0.12.0+1

Patches

Patch: bugs.freedesktop.org ↗Patch: bugs.freedesktop.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-7rq3-6hvw-rrqj: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev↗2022-05-02
▶
CVEList
CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev↗2009-11-13
▶
OSV
CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev↗2009-11-13
▶

📋Vendor Advisories

2
Red Hat
ABWOutputDev:: endWord function↗2009-08-01
▶
Debian
CVE-2009-3938: poppler - Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc...↗2009
▶

💬Community

1
Bugzilla
CVE-2009-3938 poppler buffer overflow in the ABWOutputDev::endWord function↗2009-11-13
▶
CVE-2009-3938 — Poppler vulnerability | cvebase