Evil-DB LogoEvil-DB
← All CVEs

CVE-2009-3608

high · 9.3

Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.

9.3
CVSS
10.2%
EPSS (exploit prob.)
95th
EPSS percentile
2009-10-21
Published

AV:N/AC:M/Au:N/C:C/I:C/A:C

Weaknesses

CWE-189

Affected products

VendorProductAffected versions
foolabsxpdf3.02pl1
foolabsxpdf3.02pl2
foolabsxpdf3.02pl3
glyphandcogxpdfreader3.00
glyphandcogxpdfreader3.01
glyphandcogxpdfreader3.02
popplerpoppler<= 0.12.0
popplerpoppler0.1
popplerpoppler0.1.1
popplerpoppler0.1.2
popplerpoppler0.2.0
popplerpoppler0.3.0
popplerpoppler0.3.1
popplerpoppler0.3.2
popplerpoppler0.3.3
popplerpoppler0.4.0
popplerpoppler0.4.1
popplerpoppler0.4.2
popplerpoppler0.4.3
popplerpoppler0.4.4
popplerpoppler0.5.0
popplerpoppler0.5.1
popplerpoppler0.5.2
popplerpoppler0.5.3
popplerpoppler0.5.4
popplerpoppler0.5.9
popplerpoppler0.6.0
popplerpoppler0.6.1
popplerpoppler0.6.2
popplerpoppler0.6.3
popplerpoppler0.6.4
popplerpoppler0.7.0
popplerpoppler0.7.1
popplerpoppler0.7.2
popplerpoppler0.7.3
popplerpoppler0.8.0
popplerpoppler0.8.1
popplerpoppler0.8.2
popplerpoppler0.8.3
popplerpoppler0.8.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-3608