CVE-2009-3604 The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers....
HighCVSS 9.3
EPSS 8.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| foolabs xpdf | = 3.02pl1 | No fix listed |
| foolabs xpdf | = 3.02pl2 | No fix listed |
| foolabs xpdf | = 3.02pl3 | No fix listed |
| glyphandcog xpdfreader | = 2.00 | No fix listed |
| glyphandcog xpdfreader | = 2.01 | No fix listed |
| glyphandcog xpdfreader | = 2.02 | No fix listed |
| glyphandcog xpdfreader | = 2.03 | No fix listed |
| glyphandcog xpdfreader | = 3.00 | No fix listed |
| glyphandcog xpdfreader | = 3.01 | No fix listed |
| glyphandcog xpdfreader | = 3.02 | No fix listed |
| poppler | = 0.1 | No fix listed |
| poppler | = 0.1.1 | No fix listed |
| poppler | = 0.1.2 | No fix listed |
| poppler | = 0.2.0 | No fix listed |
| poppler | = 0.3.0 | No fix listed |
| poppler | = 0.3.1 | No fix listed |
| poppler | = 0.3.2 | No fix listed |
| poppler | = 0.3.3 | No fix listed |
| poppler | = 0.4.0 | No fix listed |
| poppler | = 0.4.1 | No fix listed |
| poppler | = 0.4.2 | No fix listed |
| poppler | = 0.4.3 | No fix listed |
| poppler | = 0.4.4 | No fix listed |
| poppler | = 0.5.0 | No fix listed |
| poppler | = 0.5.1 | No fix listed |
Show 50 more
| Product | Affected versions | Fixed in |
|---|---|---|
| poppler | = 0.5.2 | No fix listed |
| poppler | = 0.5.3 | No fix listed |
| poppler | = 0.5.4 | No fix listed |
| poppler | = 0.5.9 | No fix listed |
| poppler | = 0.5.90 | No fix listed |
| poppler | = 0.5.91 | No fix listed |
| poppler | = 0.6.0 | No fix listed |
| poppler | = 0.6.1 | No fix listed |
| poppler | = 0.6.2 | No fix listed |
| poppler | = 0.6.3 | No fix listed |
| poppler | = 0.6.4 | No fix listed |
| poppler | = 0.7.0 | No fix listed |
| poppler | = 0.7.1 | No fix listed |
| poppler | = 0.7.2 | No fix listed |
| poppler | = 0.7.3 | No fix listed |
| poppler | = 0.8.0 | No fix listed |
| poppler | = 0.8.1 | No fix listed |
| poppler | = 0.8.2 | No fix listed |
| poppler | = 0.8.3 | No fix listed |
| poppler | = 0.8.4 | No fix listed |
| poppler | = 0.8.5 | No fix listed |
| poppler | = 0.8.6 | No fix listed |
| poppler | = 0.8.7 | No fix listed |
| poppler | = 0.9.0 | No fix listed |
| poppler | = 0.9.1 | No fix listed |
| poppler | = 0.9.2 | No fix listed |
| poppler | = 0.9.3 | No fix listed |
| poppler | = 0.10.0 | No fix listed |
| poppler | = 0.10.1 | No fix listed |
| poppler | = 0.10.2 | No fix listed |
| poppler | = 0.10.3 | No fix listed |
| poppler | = 0.10.4 | No fix listed |
| poppler | = 0.10.5 | No fix listed |
| poppler | = 0.10.6 | No fix listed |
| poppler | = 0.10.7 | No fix listed |
| poppler | = 0.11.0 | No fix listed |
| poppler | = 0.11.1 | No fix listed |
| poppler | = 0.11.2 | No fix listed |
| poppler | = 0.11.3 | No fix listed |
| poppler | = 0.12.0 | No fix listed |
| debian/poppler(Debian:12) | < 0.12.2-1 | 0.12.2-1 |
| debian/poppler(Debian:13) | < 0.12.2-1 | 0.12.2-1 |
| debian/poppler(Debian:14) | < 0.12.2-1 | 0.12.2-1 |
| debian/xpdf(Debian:12) | < 3.02-2 | 3.02-2 |
| debian/xpdf(Debian:13) | < 3.02-2 | 3.02-2 |
| debian/xpdf(Debian:14) | < 3.02-2 | 3.02-2 |
| ubuntu/ipe(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/ipe(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-850-1 vendor-advisory
- USN-850-3 vendor-advisory
- www.cve.org
- cgit.freedesktop.org
- cgit.freedesktop.org
- FEDORA-2010-1805 vendor-advisory
- FEDORA-2010-1842 vendor-advisory
- FEDORA-2010-1377 vendor-advisory
- SUSE-SR:2009:018 vendor-advisory
- 37023 third-party-advisory vendor-advisory
- 37028 third-party-advisory vendor-advisory
- 37037 third-party-advisory vendor-advisory
- 37042 third-party-advisory vendor-advisory
- 37043 third-party-advisory vendor-advisory
- 37053 third-party-advisory vendor-advisory
- 37077 third-party-advisory vendor-advisory
- 37079 third-party-advisory vendor-advisory
- 37114 third-party-advisory
- 37159 third-party-advisory
- 39327 third-party-advisory
- 39938 third-party-advisory
- 1023029 vdb-entry
- site.pi3.com.pl exploit
- 274030 vendor-advisory
- 1021706 vendor-advisory
- DSA-2028 vendor-advisory
- DSA-2050 vendor-advisory
- MDVSA-2009:287 vendor-advisory
- MDVSA-2010:087 vendor-advisory
- MDVSA-2011:175 vendor-advisory
- 36703 exploit patch vdb-entry
- USN-850-1 vendor-advisory
- USN-850-3 vendor-advisory
- ADV-2009-2924 patch vdb-entry vendor-advisory
- ADV-2009-2928 patch vdb-entry vendor-advisory
- ADV-2010-0802 vdb-entry
- ADV-2010-1040 vdb-entry
- ADV-2010-1220 vdb-entry
- bugzilla.redhat.com patch
- xpdf-splashdrawimage-bo(53795) vdb-entry
- oval:org.mitre.oval:def:10969 signature vdb-entry
- RHSA-2009:1500 vendor-advisory
- RHSA-2009:1501 vendor-advisory
- RHSA-2009:1502 vendor-advisory
- RHSA-2009:1503 vendor-advisory
- RHSA-2009:1512 vendor-advisory
- FEDORA-2009-10823 vendor-advisory
- FEDORA-2009-10845 vendor-advisory
- Debian Security Tracker CVE-2009-3604 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking