PT-2009-6644 · Xpdf+4 · Xpdf-Reader+15
Chris Rohlf
·
Published
1970-01-01
·
Updated
2024-06-15
·
CVE-2009-3608
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Xpdf versions prior to 3.02pl4
Poppler versions prior to 0.12.1
libkscan-dev (affected versions not specified)
kdegraphics-dev (affected versions not specified)
xpdf-common (affected versions not specified)
kviewshell (affected versions not specified)
kdegraphics-dbg (affected versions not specified)
kdegraphics-doc-html (affected versions not specified)
kdvi (affected versions not specified)
xpdf-reader (affected versions not specified)
libkscan1 (affected versions not specified)
xpdf-utils (affected versions not specified)
kdegraphics (affected versions not specified)
kdegraphics-kfile-plugins (affected versions not specified)
Description
The issue involves multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libkscan-dev, kdegraphics-dev, xpdf-common, kviewshell, kdegraphics-dbg, kdegraphics-doc-html, kdvi, xpdf-reader, libkscan1, xpdf-utils, kdegraphics, and kdegraphics-kfile-plugins. These vulnerabilities can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Recommendations
For Xpdf versions prior to 3.02pl4, update to version 3.02pl4 or later.
For Poppler versions prior to 0.12.1, update to version 0.12.1 or later.
For libkscan-dev, consider disabling the vulnerable functions until a patch is available.
For kdegraphics-dev, consider restricting access to the vulnerable modules to minimize the risk of exploitation.
For xpdf-common, kviewshell, kdegraphics-dbg, kdegraphics-doc-html, kdvi, xpdf-reader, libkscan1, xpdf-utils, kdegraphics, and kdegraphics-kfile-plugins, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Poppler
Red Hat
Xpdf
Kdegraphics
Kdegraphics-Dbg
Kdegraphics-Devel
Kdegraphics-Doc-Html
Kdegraphics-Kfile-Plugins
Kdvi
Kviewshell
Libkscan-Dev
Libkscan1
Xpdf-Common
Xpdf-Reader
Xpdf-Utils