CVE-2009-3608
Fixed in a distro release EPSS 10%
Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Products: foolabs xpdf, glyphandcog xpdfreader, poppler
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | poppler | 0.12.2-1 |
| Debian 12 | xpdf | 3.02-2 |
| Debian 13 | poppler | 0.12.2-1 |
| Debian 13 | xpdf | 3.02-2 |
| Debian 14 | poppler | 0.12.2-1 |
| Debian 14 | xpdf | 3.02-2 |
| Debian 5.0 | kdegraphics | 4:3.5.9-3+lenny3 |
| Debian 5.0 | poppler | 0.8.7-3 |
| Debian 5.0 | xpdf | 3.02-1.4+lenny2 |
| Red Hat Enterprise Linux 4 | gpdf | 0:2.8.2-7.7.2.el4_8.5 |
| Red Hat Enterprise Linux 4 | gpdf-debuginfo | 0:2.8.2-7.7.2.el4_8.5 |
| Red Hat Enterprise Linux 4 | kdegraphics | 7:3.3.1-15.el4_8.2 |
| Red Hat Enterprise Linux 4 | kdegraphics-debuginfo | 7:3.3.1-15.el4_8.2 |
| Red Hat Enterprise Linux 4 | kdegraphics-devel | 7:3.3.1-15.el4_8.2 |
| Red Hat Enterprise Linux 4 | xpdf | 1:3.00-22.el4_8.1 |
| Red Hat Enterprise Linux 4 | xpdf-debuginfo | 1:3.00-22.el4_8.1 |
| Red Hat Enterprise Linux 5 | cups | 1:1.3.7-11.el5_4.3 |
| Red Hat Enterprise Linux 5 | cups-debuginfo | 1:1.3.7-11.el5_4.3 |
| Red Hat Enterprise Linux 5 | cups-devel | 1:1.3.7-11.el5_4.3 |
| Red Hat Enterprise Linux 5 | cups-libs | 1:1.3.7-11.el5_4.3 |
| Red Hat Enterprise Linux 5 | cups-lpd | 1:1.3.7-11.el5_4.3 |
| Red Hat Enterprise Linux 5 | kdegraphics | 7:3.5.4-15.el5_4.2 |
| Red Hat Enterprise Linux 5 | kdegraphics-debuginfo | 7:3.5.4-15.el5_4.2 |
| Red Hat Enterprise Linux 5 | kdegraphics-devel | 7:3.5.4-15.el5_4.2 |
| Red Hat Enterprise Linux 5 | poppler | 0:0.5.4-4.4.el5_4.11 |
| Red Hat Enterprise Linux 5 | poppler-debuginfo | 0:0.5.4-4.4.el5_4.11 |
| Red Hat Enterprise Linux 5 | poppler-devel | 0:0.5.4-4.4.el5_4.11 |
| Red Hat Enterprise Linux 5 | poppler-utils | 0:0.5.4-4.4.el5_4.11 |
| Red Hat Enterprise Linux 5 | tetex | 0:3.0-33.8.el5_5.5 |
| Red Hat Enterprise Linux 5 | tetex-afm | 0:3.0-33.8.el5_5.5 |
| Red Hat Enterprise Linux 5 | tetex-debuginfo | 0:3.0-33.8.el5_5.5 |
| Red Hat Enterprise Linux 5 | tetex-doc | 0:3.0-33.8.el5_5.5 |
| Red Hat Enterprise Linux 5 | tetex-dvips | 0:3.0-33.8.el5_5.5 |
| Red Hat Enterprise Linux 5 | tetex-fonts | 0:3.0-33.8.el5_5.5 |
| Red Hat Enterprise Linux 5 | tetex-latex | 0:3.0-33.8.el5_5.5 |
| Red Hat Enterprise Linux 5 | tetex-xdvi | 0:3.0-33.8.el5_5.5 |
| Red Hat rhel productivity 5 | kdegraphics | 7:3.5.4-15.el5_4.2 |
| Red Hat rhel productivity 5 | kdegraphics-debuginfo | 7:3.5.4-15.el5_4.2 |
| Red Hat rhel productivity 5 | kdegraphics-devel | 7:3.5.4-15.el5_4.2 |
| Ubuntu 16.04 LTS | ipe | no fix |
| Ubuntu 18.04 LTS | ipe | no fix |
| Ubuntu 20.04 LTS | ipe | no fix |
| Ubuntu 22.04 LTS | ipe | no fix |
| Ubuntu 24.04 LTS | ipe | no fix |
| Ubuntu 25.10 | ipe | no fix |
| Ubuntu 26.04 LTS | ipe | no fix |
| Ubuntu 26.10 | ipe | no fix |
| openSUSE Tumbleweed | poppler | 0.49.0-1.1 |