PT-2009-6642 · Kde+3 · Kdegraphics-Doc-Html+11

Adam Zabrocki · Published 1970-01-01 · Updated 2023-02-13 · CVE-2009-3604

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics versions prior to 3.02pl4 Xpdf versions 2.x and 3.x before 3.02pl4 Poppler version 0.x libkscan-dev (affected versions not specified) kdegraphics-dev (affected versions not specified) xpdf-common (affected versions not specified) kviewshell (affected versions not specified) kdegraphics-dbg (affected versions not specified) kdegraphics-doc-html (affected versions not specified) kdvi (affected versions not specified) xpdf-reader (affected versions not specified) kdegraphics (affected versions not specified) libkscan1 (affected versions not specified) xpdf-utils (affected versions not specified) kdegraphics-kfile-plugins (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libkscan-dev, kdegraphics-dev, xpdf-common, kviewshell, kdegraphics-dbg, kdegraphics-doc-html, kdvi, xpdf-reader, kdegraphics, libkscan1, xpdf-utils, and kdegraphics-kfile-plugins. These vulnerabilities can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information. The Splash::drawImage function in Splash.cc in Xpdf and Poppler does not properly allocate memory, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted PDF document.

Recommendations For Xpdf versions 2.x and 3.x, update to version 3.02pl4 or later. For Poppler version 0.x, update to a version that includes the fix for the memory allocation issue. For kdegraphics versions prior to 3.02pl4, update to version 3.02pl4 or later. For libkscan-dev, kdegraphics-dev, xpdf-common, kviewshell, kdegraphics-dbg, kdegraphics-doc-html, kdvi, xpdf-reader, kdegraphics, libkscan1, xpdf-utils, and kdegraphics-kfile-plugins, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-399

CWE-189

Related Identifiers

BDU:2015-00990

BDU:2015-00991

BDU:2015-00992

BDU:2015-00993

BDU:2015-00994

BDU:2015-00995

BDU:2015-00996

BDU:2015-00997

BDU:2015-00998

BDU:2015-02167

BDU:2015-02168

BDU:2015-02169

CVE-2009-3604

DSA-1941-1

DSA-2028-1

DSA-2050-1

RHSA-2009:0480

RHSA-2009:1500

RHSA-2009:1501

RHSA-2009:1502

RHSA-2009:1503

RHSA-2009:1512

RHSA-2009_0480

RHSA-2009_1501

RHSA-2009_1502

RHSA-2009_1503

RHSA-2009_1512

USN-850-1

USN-850-3

Affected Products

Debian

Poppler

Red Hat

Kdegraphics

Kdegraphics-Dbg

Kdegraphics-Devel

Kdegraphics-Doc-Html

Kdegraphics-Kfile-Plugins

Kdvi

Kviewshell

Libkscan-Dev

Libkscan1

References · 118

• 🔥 http://site.pi3.com.pl/adv/xpdf.txt · Exploit
• 🔥 http://securityfocus.com/bid/36703 · Exploit
• https://rhn.redhat.com/errata/RHSA-2009-1500.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04167 · Security Note
• https://osv.dev/vulnerability/CVE-2009-3604 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2009-1512.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02169 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:287 · Vendor Advisory
• http://secunia.com/advisories/37053 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00993 · Security Note
• https://cve.org/CVERecord?id=CVE-2009-3604 · Security Note
• http://secunia.com/advisories/37077 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00992 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-3604 · Vendor Advisory