CVE-2009-3603 Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that....
HighCVSS 9.3
EPSS 8.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| foolabs xpdf | = 3.02pl1 | No fix listed |
| foolabs xpdf | = 3.02pl2 | No fix listed |
| foolabs xpdf | = 3.02pl3 | No fix listed |
| glyphandcog xpdfreader | = 3.00 | No fix listed |
| glyphandcog xpdfreader | = 3.01 | No fix listed |
| glyphandcog xpdfreader | = 3.02 | No fix listed |
| poppler | <= 0.12.0 | No fix listed |
| poppler | = 0.1 | No fix listed |
| poppler | = 0.1.1 | No fix listed |
| poppler | = 0.1.2 | No fix listed |
| poppler | = 0.2.0 | No fix listed |
| poppler | = 0.3.0 | No fix listed |
| poppler | = 0.3.1 | No fix listed |
| poppler | = 0.3.2 | No fix listed |
| poppler | = 0.3.3 | No fix listed |
| poppler | = 0.4.0 | No fix listed |
| poppler | = 0.4.1 | No fix listed |
| poppler | = 0.4.2 | No fix listed |
| poppler | = 0.4.3 | No fix listed |
| poppler | = 0.4.4 | No fix listed |
| poppler | = 0.5.0 | No fix listed |
| poppler | = 0.5.1 | No fix listed |
| poppler | = 0.5.2 | No fix listed |
| poppler | = 0.5.3 | No fix listed |
| poppler | = 0.5.4 | No fix listed |
Show 43 more
| Product | Affected versions | Fixed in |
|---|---|---|
| poppler | = 0.5.9 | No fix listed |
| poppler | = 0.6.0 | No fix listed |
| poppler | = 0.6.1 | No fix listed |
| poppler | = 0.6.2 | No fix listed |
| poppler | = 0.6.3 | No fix listed |
| poppler | = 0.6.4 | No fix listed |
| poppler | = 0.7.0 | No fix listed |
| poppler | = 0.7.1 | No fix listed |
| poppler | = 0.7.2 | No fix listed |
| poppler | = 0.7.3 | No fix listed |
| poppler | = 0.8.0 | No fix listed |
| poppler | = 0.8.1 | No fix listed |
| poppler | = 0.8.2 | No fix listed |
| poppler | = 0.8.3 | No fix listed |
| poppler | = 0.8.4 | No fix listed |
| poppler | = 0.8.6 | No fix listed |
| poppler | = 0.8.7 | No fix listed |
| poppler | = 0.9.0 | No fix listed |
| poppler | = 0.9.1 | No fix listed |
| poppler | = 0.9.2 | No fix listed |
| poppler | = 0.9.3 | No fix listed |
| poppler | = 0.10.0 | No fix listed |
| poppler | = 0.10.1 | No fix listed |
| poppler | = 0.10.2 | No fix listed |
| poppler | = 0.10.3 | No fix listed |
| poppler | = 0.10.4 | No fix listed |
| poppler | = 0.10.5 | No fix listed |
| poppler | = 0.10.6 | No fix listed |
| poppler | = 0.10.7 | No fix listed |
| poppler | = 0.11.0 | No fix listed |
| poppler | = 0.11.1 | No fix listed |
| poppler | = 0.11.2 | No fix listed |
| poppler | = 0.11.3 | No fix listed |
| debian/poppler(Debian:12) | < 0.12.2-1 | 0.12.2-1 |
| debian/poppler(Debian:13) | < 0.12.2-1 | 0.12.2-1 |
| debian/poppler(Debian:14) | < 0.12.2-1 | 0.12.2-1 |
| debian/xpdf(Debian:12) | < 3.02-2 | 3.02-2 |
| debian/xpdf(Debian:13) | < 3.02-2 | 3.02-2 |
| debian/xpdf(Debian:14) | < 3.02-2 | 3.02-2 |
| ubuntu/ipe(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-850-1 vendor-advisory
- USN-850-3 vendor-advisory
- www.cve.org
- FEDORA-2010-1805 vendor-advisory
- FEDORA-2010-1842 vendor-advisory
- FEDORA-2010-1377 vendor-advisory
- SUSE-SR:2009:018 vendor-advisory
- poppler.freedesktop.org patch vendor-advisory
- 37034 third-party-advisory vendor-advisory
- 37053 third-party-advisory vendor-advisory
- 37054 third-party-advisory vendor-advisory
- 37114 third-party-advisory
- 37159 third-party-advisory
- 39327 third-party-advisory
- 39938 third-party-advisory
- 1023029 vdb-entry
- 274030 vendor-advisory
- 1021706 vendor-advisory
- DSA-2028 vendor-advisory
- DSA-2050 vendor-advisory
- MDVSA-2009:287 vendor-advisory
- MDVSA-2010:087 vendor-advisory
- MDVSA-2011:175 vendor-advisory
- 36703 exploit patch vdb-entry
- USN-850-1 vendor-advisory
- USN-850-3 vendor-advisory
- ADV-2009-2924 patch vdb-entry vendor-advisory
- ADV-2009-2925 patch vdb-entry vendor-advisory
- ADV-2010-0802 vdb-entry
- ADV-2010-1040 vdb-entry
- ADV-2010-1220 vdb-entry
- bugzilla.redhat.com
- xpdf-splashbitmap-bo(53793) vdb-entry
- oval:org.mitre.oval:def:9671 signature vdb-entry
- RHSA-2009:1504 vendor-advisory
- FEDORA-2009-10823 vendor-advisory
- FEDORA-2009-10845 vendor-advisory
- Debian Security Tracker CVE-2009-3603 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking