CVE-2009-3608

NameCVE-2009-3608
DescriptionInteger overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1941-1, DSA-2028-1, DSA-2050-1
Debian Bugs551287, 551289, 551290

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
poppler (PTS)buster0.71.0-5fixed
buster (security)0.71.0-5+deb10u3fixed
bullseye (security), bullseye20.09.0-3.1+deb11u1fixed
bookworm, trixie22.12.0-2fixed
sid22.12.0-2.2fixed
xpdf (PTS)buster3.04-13fixed
bullseye3.04+git20210103-3fixed
bookworm3.04+git20220601-1fixed
sid, trixie3.04+git20240202-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kdegraphicssourcelenny4:3.5.9-3+lenny3DSA-2050-1
kdegraphicssource(unstable)4:4.0medium551290
popplersourcelenny0.8.7-3DSA-1941-1
popplersource(unstable)0.12.2-1medium551289
swftoolssource(unstable)0.9.2+ds1-2
xpdfsourcelenny3.02-1.4+lenny2DSA-2028-1
xpdfsource(unstable)3.02-2medium551287

Search for package or bug name: Reporting problems