Description
Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cups | 1.3.10-1 | — |
| Debian 13 | cups | 1.3.10-1 | — |
| Debian 12 | cups | 1.3.10-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdegraphics +1 | 7:3.5.4-15.el5_4.2 | RHSA-2009:1502 |
| RHEL 5 | poppler +2 | 0.5.4-4.4.el5_3.9 | RHSA-2009:0480 |
| RHEL 5 | tetex +6 | 3.0-33.8.el5_5.5 | RHSA-2010:0400 |
| RHEL 4 | cups +2 | 1:1.1.22-0.rc1.9.32.el4_8.3 | RHSA-2009:1083 |
| RHEL 4 | gpdf | 2.8.2-7.7.2.el4_8.5 | RHSA-2009:1503 |
| RHEL 4 | kdegraphics +1 | 7:3.3.1-15.el4_8.2 | RHSA-2009:1512 |
| RHEL 4 | tetex +6 | 2.0.2-22.0.1.EL4.16 | RHSA-2010:0399 |
| RHEL 4 | xpdf | 1:3.00-22.el4_8.1 | RHSA-2009:1501 |
| RHEL 3 | cups +2 | 1:1.1.17-13.3.62 | RHSA-2009:1083 |
| RHEL 3 | tetex +5 | 1.0.7-67.19 | RHSA-2010:0401 |
| RHEL 3 | xpdf | 1:2.02-17.el3 | RHSA-2009:1500 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | kdegraphics +1 | 7:3.5.4-15.el5_4.2 | RHSA-2009:1502 |
Advisories 10
- RHSA-2009:1502 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0480 Red Hat Security Advisory: poppler security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0400 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0401 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0399 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1512 Red Hat Security Advisory: kdegraphics security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1503 Red Hat Security Advisory: gpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1501 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1500 Red Hat Security Advisory: xpdf security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1083 Red Hat Security Advisory: cups security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 1022326 vdb-entry
- oval:org.mitre.oval:def:10534 vdb-entry signature
- 35195 vdb-entry
- 37028 third-party-advisory
- 35340 third-party-advisory
- RHSA-2009:1501 vendor-advisory
- 37079 third-party-advisory
- ADV-2009-1488 vdb-entry
- RHSA-2009:1512 vendor-advisory
- 37077 third-party-advisory
- RHSA-2009:1503 vendor-advisory
- cups-pdftops-filter-bo(50941) vdb-entry
- 37037 third-party-advisory
- RHSA-2009:1502 vendor-advisory
- RHSA-2009:1500 vendor-advisory
- ADV-2009-2928 vdb-entry
- 37023 third-party-advisory
- 35685 third-party-advisory
- SUSE-SR:2009:012 vendor-advisory
- 37043 third-party-advisory
- RHSA-2009:1083 vendor-advisory
- MDVSA-2009:334 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=491840