CVE-2009-4035
Fixed in a distro release EPSS 4%
The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.
Products: gnome gpdf, kdegraphics, kde kpdf, xpdf
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | poppler | 0.5.1-1 |
| Debian 12 | xpdf | 3.01-1 |
| Debian 13 | poppler | 0.5.1-1 |
| Debian 13 | xpdf | 3.01-1 |
| Debian 14 | poppler | 0.5.1-1 |
| Debian 14 | xpdf | 3.01-1 |
| Red Hat Enterprise Linux 4 | gpdf | 0:2.8.2-7.7.2.el4_8.6 |
| Red Hat Enterprise Linux 4 | gpdf-debuginfo | 0:2.8.2-7.7.2.el4_8.6 |
| Red Hat Enterprise Linux 4 | kdegraphics | 7:3.3.1-17.el4_8.1 |
| Red Hat Enterprise Linux 4 | kdegraphics-debuginfo | 7:3.3.1-17.el4_8.1 |
| Red Hat Enterprise Linux 4 | kdegraphics-devel | 7:3.3.1-17.el4_8.1 |
| Red Hat Enterprise Linux 4 | xpdf | 1:3.00-23.el4_8.1 |
| Red Hat Enterprise Linux 4 | xpdf-debuginfo | 1:3.00-23.el4_8.1 |