CVE-2009-4035

CWE-94 — Code Injection7 documents7 sources
Severity
9.3CRITICAL
EPSS
2.5%
top 14.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Gnome GpdfKDE KdegraphicsKDE Kpdf+1 more
Timeline
PublishedDec 21
Latest updateMay 2

Description

The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages6 packages

▶Debianxpdf< 3.01-1+3
▶NVDkde/kpdf3.3.1
▶NVDxpdf/xpdf3.0.0
▶NVDgnome/gpdf2.8.2
▶NVDkde/kdegraphics3.3.1

🔴Vulnerability Details

3
GHSA
GHSA-9rm4-mjvc-4m49: The FoFiType1::parse function in fofi/FoFiType1↗2022-05-02
▶
OSV
CVE-2009-4035: The FoFiType1::parse function in fofi/FoFiType1↗2009-12-21
▶
CVEList
CVE-2009-4035: The FoFiType1::parse function in fofi/FoFiType1↗2009-12-21
▶

📋Vendor Advisories

2
Red Hat
xpdf: buffer overflow in FoFiType1::parse↗2009-12-16
▶
Debian
CVE-2009-4035: poppler - The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kp...↗2009
▶

💬Community

1
Bugzilla
CVE-2009-4035 xpdf: buffer overflow in FoFiType1::parse↗2009-11-26
▶
CVE-2009-4035 (CRITICAL CVSS 9.3) | The FoFiType1::parse function in fo | cvebase.io