CVE-2009-3607 Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute....
HighCVSS 9.3
EPSS 5.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| poppler | = 0.1 | No fix listed |
| poppler | = 0.1.1 | No fix listed |
| poppler | = 0.1.2 | No fix listed |
| poppler | = 0.2.0 | No fix listed |
| poppler | = 0.3.0 | No fix listed |
| poppler | = 0.3.1 | No fix listed |
| poppler | = 0.3.2 | No fix listed |
| poppler | = 0.3.3 | No fix listed |
| poppler | = 0.4.0 | No fix listed |
| poppler | = 0.4.1 | No fix listed |
| poppler | = 0.4.2 | No fix listed |
| poppler | = 0.4.3 | No fix listed |
| poppler | = 0.4.4 | No fix listed |
| poppler | = 0.5.0 | No fix listed |
| poppler | = 0.5.1 | No fix listed |
| poppler | = 0.5.2 | No fix listed |
| poppler | = 0.5.3 | No fix listed |
| poppler | = 0.5.4 | No fix listed |
| poppler | = 0.5.9 | No fix listed |
| poppler | = 0.5.90 | No fix listed |
| poppler | = 0.5.91 | No fix listed |
| poppler | = 0.6.0 | No fix listed |
| poppler | = 0.6.1 | No fix listed |
| poppler | = 0.6.2 | No fix listed |
| poppler | = 0.6.3 | No fix listed |
Show 33 more
| Product | Affected versions | Fixed in |
|---|---|---|
| poppler | = 0.6.4 | No fix listed |
| poppler | = 0.7.0 | No fix listed |
| poppler | = 0.7.1 | No fix listed |
| poppler | = 0.7.2 | No fix listed |
| poppler | = 0.7.3 | No fix listed |
| poppler | = 0.8.0 | No fix listed |
| poppler | = 0.8.1 | No fix listed |
| poppler | = 0.8.2 | No fix listed |
| poppler | = 0.8.3 | No fix listed |
| poppler | = 0.8.4 | No fix listed |
| poppler | = 0.8.5 | No fix listed |
| poppler | = 0.8.6 | No fix listed |
| poppler | = 0.8.7 | No fix listed |
| poppler | = 0.9.0 | No fix listed |
| poppler | = 0.9.1 | No fix listed |
| poppler | = 0.9.2 | No fix listed |
| poppler | = 0.9.3 | No fix listed |
| poppler | = 0.10.0 | No fix listed |
| poppler | = 0.10.1 | No fix listed |
| poppler | = 0.10.2 | No fix listed |
| poppler | = 0.10.3 | No fix listed |
| poppler | = 0.10.4 | No fix listed |
| poppler | = 0.10.5 | No fix listed |
| poppler | = 0.10.6 | No fix listed |
| poppler | = 0.10.7 | No fix listed |
| poppler | = 0.11.0 | No fix listed |
| poppler | = 0.11.1 | No fix listed |
| poppler | = 0.11.2 | No fix listed |
| poppler | = 0.11.3 | No fix listed |
| poppler | = 0.12.0 | No fix listed |
| debian/poppler(Debian:12) | < 0.12.2-1 | 0.12.2-1 |
| debian/poppler(Debian:13) | < 0.12.2-1 | 0.12.2-1 |
| debian/poppler(Debian:14) | < 0.12.2-1 | 0.12.2-1 |
References
- cgit.freedesktop.org
- 37054 third-party-advisory vendor-advisory
- 37114 third-party-advisory
- 37159 third-party-advisory
- 274030 vendor-advisory
- 1021706 vendor-advisory
- DSA-1941 vendor-advisory
- MDVSA-2011:175 vendor-advisory
- [oss-security] 20091130 Need more information on recent poppler issues mailing-list
- [oss-security] 20091130 Re: Need more information on recent poppler issues mailing-list
- [oss-security] 20091201 Re: Need more information on recent poppler issues mailing-list
- 36718 vdb-entry
- USN-850-1 vendor-advisory
- USN-850-3 vendor-advisory
- ADV-2009-2925 vdb-entry vendor-advisory
- bugzilla.redhat.com
- poppler-createsurfacefromthumbnaildata-bo(53801) vdb-entry
- FEDORA-2009-10823 vendor-advisory
- FEDORA-2009-10845 vendor-advisory
- Debian Security Tracker CVE-2009-3607 vendor-advisory
- bugs.debian.org issue-tracking