CVE-2009-0146

Name	CVE-2009-0146
Description	Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and ...
Source	CVE (at NVD; oss-sec, OSVDB, EDB, Red Hat, Ubuntu, Gentoo, more)
References	DSA-1790-1, DSA-1793-1
Debian Bugs	524806, 524809, 524810
Debian/oldstable	not vulnerable.
Debian/stable	not vulnerable.
Debian/testing	not vulnerable.
Debian/unstable	not vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cups (PTS)	squeeze (security)	1.4.4-7+squeeze2	fixed
	squeeze	1.4.4-7+squeeze3	fixed
	wheezy	1.5.3-5+deb7u1	fixed
	jessie, sid	1.7.1-7	fixed
kdegraphics (PTS)	squeeze	4:4.4.5-2	fixed
poppler (PTS)	squeeze, squeeze (security)	0.12.4-1.2+squeeze3	fixed
	wheezy	0.18.4-6	fixed
	jessie, sid	0.22.5-4	fixed
swftools (PTS)	wheezy	0.9.2+ds1-3	fixed
	jessie	0.9.2+git20130725-1	fixed
	sid	0.9.2+git20130725-2	fixed
xpdf (PTS)	squeeze	3.02-12+squeeze1	fixed
	wheezy	3.03-10	fixed
	jessie, sid	3.03-16	fixed

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
cups	source	(unstable)	(not affected)
kdegraphics	source	(unstable)	4:4.0	medium		524810
kdegraphics	source	etch	4:3.5.5-3etch3		DSA-1793-1
kdegraphics	source	lenny	4:3.5.9-3+lenny1		DSA-1793-1
poppler	source	(unstable)	0.10.6-1	medium		524806
poppler	source	lenny	0.8.7-2
swftools	source	(unstable)	0.9.2+ds1-2
xpdf	source	(unstable)	3.02-1.4+lenny1	medium		524809
xpdf	source	etch	3.01-9.1+etch6		DSA-1790-1
xpdf	source	lenny	3.02-1.4+lenny1		DSA-1790-1
xpdf	source	squeeze	3.02-1.4+lenny1

- cups <not-affected> (Uses poppler's pdftops)