CVE-2009-3604
Fixed in a distro release EPSS 9%
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Products: foolabs xpdf, glyphandcog xpdfreader, poppler
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | poppler | 0.12.2-1 |
| Debian 12 | xpdf | 3.02-2 |
| Debian 13 | poppler | 0.12.2-1 |
| Debian 13 | xpdf | 3.02-2 |
| Debian 14 | poppler | 0.12.2-1 |
| Debian 14 | xpdf | 3.02-2 |
| Debian 5.0 | kdegraphics | 4:3.5.9-3+lenny3 |
| Debian 5.0 | poppler | 0.8.7-3 |
| Debian 5.0 | xpdf | 3.02-1.4+lenny2 |
| Red Hat Enterprise Linux 3 | xpdf | 1:2.02-17.el3 |
| Red Hat Enterprise Linux 3 | xpdf-debuginfo | 1:2.02-17.el3 |
| Red Hat Enterprise Linux 4 | gpdf | 0:2.8.2-7.7.2.el4_8.5 |
| Red Hat Enterprise Linux 4 | gpdf-debuginfo | 0:2.8.2-7.7.2.el4_8.5 |
| Red Hat Enterprise Linux 4 | kdegraphics | 7:3.3.1-15.el4_8.2 |
| Red Hat Enterprise Linux 4 | kdegraphics-debuginfo | 7:3.3.1-15.el4_8.2 |
| Red Hat Enterprise Linux 4 | kdegraphics-devel | 7:3.3.1-15.el4_8.2 |
| Red Hat Enterprise Linux 4 | xpdf | 1:3.00-22.el4_8.1 |
| Red Hat Enterprise Linux 4 | xpdf-debuginfo | 1:3.00-22.el4_8.1 |
| Red Hat Enterprise Linux 5 | kdegraphics | 7:3.5.4-15.el5_4.2 |
| Red Hat Enterprise Linux 5 | kdegraphics-debuginfo | 7:3.5.4-15.el5_4.2 |
| Red Hat Enterprise Linux 5 | kdegraphics-devel | 7:3.5.4-15.el5_4.2 |
| Red Hat Enterprise Linux 5 | poppler | 0:0.5.4-4.4.el5_3.9 |
| Red Hat Enterprise Linux 5 | poppler-debuginfo | 0:0.5.4-4.4.el5_3.9 |
| Red Hat Enterprise Linux 5 | poppler-devel | 0:0.5.4-4.4.el5_3.9 |
| Red Hat Enterprise Linux 5 | poppler-utils | 0:0.5.4-4.4.el5_3.9 |
| Red Hat rhel productivity 5 | kdegraphics | 7:3.5.4-15.el5_4.2 |
| Red Hat rhel productivity 5 | kdegraphics-debuginfo | 7:3.5.4-15.el5_4.2 |
| Red Hat rhel productivity 5 | kdegraphics-devel | 7:3.5.4-15.el5_4.2 |
| Ubuntu 16.04 LTS | ipe | no fix |
| Ubuntu 18.04 LTS | ipe | no fix |
| Ubuntu 20.04 LTS | ipe | no fix |
| Ubuntu 22.04 LTS | ipe | no fix |
| Ubuntu 24.04 LTS | ipe | no fix |
| Ubuntu 25.10 | ipe | no fix |
| Ubuntu 26.04 LTS | ipe | no fix |
| Ubuntu 26.10 | ipe | no fix |