CVE-2009-0791

NameCVE-2009-0791
DescriptionMultiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs535488, 535489

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)stretch2.2.1-8+deb9u6fixed
stretch (security)2.2.1-8+deb9u7fixed
buster2.2.10-6+deb10u4fixed
bullseye2.3.3op2-3+deb11u1fixed
bookworm, sid2.3.3op2-7fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssourcelenny(not affected)
cupssource(unstable)1.3.10-1medium535489
cupsyssourceetch(not affected)
cupsyssource(unstable)(unfixed)medium535488

Notes

[etch] - cupsys <not-affected> (pdftops source included, but not built)
[lenny] - cups <not-affected> (pdftops source included, but not built)

Search for package or bug name: Reporting problems