CVE-2009-0791

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.

References

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html

http://secunia.com/advisories/35340

http://secunia.com/advisories/35685

http://secunia.com/advisories/37023

http://secunia.com/advisories/37028

http://secunia.com/advisories/37037

http://secunia.com/advisories/37043

http://secunia.com/advisories/37077

http://secunia.com/advisories/37079

http://securitytracker.com/id?1022326

http://www.mandriva.com/security/advisories?name=MDVSA-2009:334

http://www.redhat.com/support/errata/RHSA-2009-1083.html

http://www.securityfocus.com/bid/35195

http://www.vupen.com/english/advisories/2009/1488

http://www.vupen.com/english/advisories/2009/2928

https://bugzilla.redhat.com/show_bug.cgi?id=491840

https://exchange.xforce.ibmcloud.com/vulnerabilities/50941

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10534

https://rhn.redhat.com/errata/RHSA-2009-1500.html

https://rhn.redhat.com/errata/RHSA-2009-1501.html

https://rhn.redhat.com/errata/RHSA-2009-1502.html

https://rhn.redhat.com/errata/RHSA-2009-1503.html

https://rhn.redhat.com/errata/RHSA-2009-1512.html

Details

Source: MITRE

Published: 2009-06-09

Updated: 2017-09-29

Type: CWE-189

Risk Information

CVSS v2

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (50 total)

IDNameProductFamilySeverity
68040Oracle Linux 3 : tetex (ELSA-2010-0401)NessusOracle Linux Local Security Checks
medium
68039Oracle Linux 5 : tetex (ELSA-2010-0400)NessusOracle Linux Local Security Checks
high
68038Oracle Linux 4 : tetex (ELSA-2010-0399)NessusOracle Linux Local Security Checks
high
67943Oracle Linux 4 : kdegraphics (ELSA-2009-1512)NessusOracle Linux Local Security Checks
high
67941Oracle Linux 4 : gpdf (ELSA-2009-1503)NessusOracle Linux Local Security Checks
high
67940Oracle Linux 4 : xpdf (ELSA-2009-1501)NessusOracle Linux Local Security Checks
high
67939Oracle Linux 3 : xpdf (ELSA-2009-1500)NessusOracle Linux Local Security Checks
high
67868Oracle Linux 3 / 4 : cups (ELSA-2009-1083)NessusOracle Linux Local Security Checks
medium
67858Oracle Linux 5 : poppler (ELSA-2009-0480)NessusOracle Linux Local Security Checks
high
60791Scientific Linux Security Update : tetex on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
high
60790Scientific Linux Security Update : tetex on SL4.x i386/x86_64NessusScientific Linux Local Security Checks
high
60789Scientific Linux Security Update : tetex on SL3.x i386/x86_64NessusScientific Linux Local Security Checks
medium
60681Scientific Linux Security Update : xpdf on SL3.x, SL4.x i386/x86_64NessusScientific Linux Local Security Checks
high
60679Scientific Linux Security Update : kdegraphics on SL4.x, SL5.x i386/x86_64NessusScientific Linux Local Security Checks
high
60678Scientific Linux Security Update : gpdf on SL4.x i386/x86_64NessusScientific Linux Local Security Checks
high
60592Scientific Linux Security Update : cups on SL3.x, SL4.x, SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
46760CentOS 5 : tetex (CESA-2010:0400)NessusCentOS Local Security Checks
high
46310RHEL 3 : tetex (RHSA-2010:0401)NessusRed Hat Local Security Checks
medium
46309RHEL 5 : tetex (RHSA-2010:0400)NessusRed Hat Local Security Checks
high
46308RHEL 4 : tetex (RHSA-2010:0399)NessusRed Hat Local Security Checks
high
46258CentOS 3 : tetex (CESA-2010:0401)NessusCentOS Local Security Checks
medium
46257CentOS 4 : tetex (CESA-2010:0399)NessusCentOS Local Security Checks
high
43856openSUSE Security Update : libpoppler-devel (libpoppler-devel-1735)NessusSuSE Local Security Checks
high
43805CentOS 4 : kdegraphics (CESA-2009:1512)NessusCentOS Local Security Checks
high
43803CentOS 4 : gpdf (CESA-2009:1503)NessusCentOS Local Security Checks
high
43802CentOS 5 : kdegraphics (CESA-2009:1502)NessusCentOS Local Security Checks
high
43801CentOS 4 : xpdf (CESA-2009:1501)NessusCentOS Local Security Checks
high
43748CentOS 5 : poppler (CESA-2009:0480)NessusCentOS Local Security Checks
high
43620SuSE 11 Security Update : libpoppler (SAT Patch Number 1731)NessusSuSE Local Security Checks
high
43618SuSE 11.2 Security Update: libpoppler-devel (2009-12-22)NessusSuSE Local Security Checks
high
43617openSUSE Security Update : libpoppler-devel (libpoppler-devel-1741)NessusSuSE Local Security Checks
high
43616openSUSE Security Update : libpoppler-devel (libpoppler-devel-1740)NessusSuSE Local Security Checks
high
42181Mandriva Linux Security Advisory : cups (MDVSA-2009:282-1)NessusMandriva Local Security Checks
critical
42164RHEL 4 : kdegraphics (RHSA-2009:1512)NessusRed Hat Local Security Checks
high
42162RHEL 4 : gpdf (RHSA-2009:1503)NessusRed Hat Local Security Checks
high
42161RHEL 5 : kdegraphics (RHSA-2009:1502)NessusRed Hat Local Security Checks
high
42160RHEL 4 : xpdf (RHSA-2009:1501)NessusRed Hat Local Security Checks
high
42159RHEL 3 : xpdf (RHSA-2009:1500)NessusRed Hat Local Security Checks
high
42151CentOS 3 : xpdf (CESA-2009:1500)NessusCentOS Local Security Checks
high
42042openSUSE 10 Security Update : xpdf (xpdf-6376)NessusSuSE Local Security Checks
medium
41603SuSE 10 Security Update : xpdf (ZYPP Patch Number 6378)NessusSuSE Local Security Checks
medium
41495SuSE 10 Security Update : CUPS (ZYPP Patch Number 6279)NessusSuSE Local Security Checks
medium
41463SuSE 11 Security Update : xpdf (SAT Patch Number 1140)NessusSuSE Local Security Checks
medium
41304SuSE9 Security Update : CUPS (YOU Patch Number 12434)NessusSuSE Local Security Checks
medium
40793openSUSE Security Update : xpdf (xpdf-1138)NessusSuSE Local Security Checks
medium
40787openSUSE Security Update : xpdf (xpdf-1138)NessusSuSE Local Security Checks
medium
39389openSUSE 10 Security Update : cups (cups-6285)NessusSuSE Local Security Checks
medium
39307RHEL 3 / 4 : cups (RHSA-2009:1083)NessusRed Hat Local Security Checks
medium
39303CentOS 3 / 4 : cups (CESA-2009:1083)NessusCentOS Local Security Checks
medium
38769RHEL 5 : poppler (RHSA-2009:0480)NessusRed Hat Local Security Checks
high