CVE-2009-3608

Name	CVE-2009-3608
Description	Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1941-1, DSA-2028-1, DSA-2050-1
Debian Bugs	551287, 551289, 551290

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
poppler (PTS)	bullseye (security), bullseye	20.09.0-3.1+deb11u1	fixed
	bookworm	22.12.0-2	fixed
	sid, trixie	24.08.0-3	fixed
xpdf (PTS)	bullseye	3.04+git20210103-3	fixed
	bookworm	3.04+git20220601-1	fixed
	sid, trixie	3.04+git20240613-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
kdegraphics	source	lenny	4:3.5.9-3+lenny3		DSA-2050-1
kdegraphics	source	(unstable)	4:4.0	medium		551290
poppler	source	lenny	0.8.7-3		DSA-1941-1
poppler	source	(unstable)	0.12.2-1	medium		551289
swftools	source	(unstable)	0.9.2+ds1-2
xpdf	source	lenny	3.02-1.4+lenny2		DSA-2028-1
xpdf	source	(unstable)	3.02-2	medium		551287