The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.

The remote host is affected by the vulnerability described in GLSA-201402-17 (Xpdf: User-assisted execution of arbitrary code)

    Multiple vulnerabilities have been discovered in Xpdf. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

From Red Hat Security Advisory 2009:1682 :

Updated kdegraphics packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment, including KPDF, a viewer for Portable Document Format (PDF) files.

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in KPDF's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause KPDF to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

From Red Hat Security Advisory 2009:1681 :

An updated gpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GPdf is a viewer for Portable Document Format (PDF) files.

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in GPdf's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause GPdf to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

From Red Hat Security Advisory 2009:1680 :

An updated xpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Xpdf is an X Window System based viewer for Portable Document Format (PDF) files.

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in Xpdf's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause Xpdf to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in Xpdf's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause Xpdf to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in KPDF's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause KPDF to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in GPdf's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause GPdf to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

This update of poppler fixes two security issues :

  - Integer overflow in the ObjectStream::ObjectStream     function in XRef.cc in Xpdf 3.x before 3.02pl4 and     Poppler before 0.12.1, as used in GPdf, kdegraphics     KPDF, CUPS pdftops, and teTeX, might allow remote     attackers to execute arbitrary code via a crafted PDF     document that triggers a heap-based buffer overflow.
    (CVE-2009-3608)

  - A indexing error in FoFiType1::parse() was fixed that     could be used by attackers to corrupt memory and     potentially execute code. (CVE-2009-4035)

This update of libpoppler5 fixes various security issues.

CVE-2009-0791: Fix multiple integer overflows in 'pdftops' filter that could be used by attackers to execute code.

CVE-2009-3607: Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information. 

CVE-2009-3608: Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. 

CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file. 

CVE-2009-4035: A indexing error in FoFiType1::parse() was fixed that could be used by attackers to corrupt memory and potentially execute code.

This update of libpoppler4 fixes various security issues.

  - Fix multiple integer overflows in 'pdftops' filter that     could be used by attackers to execute code.
    (CVE-2009-0791)

  - Integer overflow in the     create_surface_from_thumbnail_data function in     glib/poppler-page.cc in Poppler 0.x allows remote     attackers to cause a denial of service (memory     corruption) or possibly execute arbitrary code via a     crafted PDF document that triggers a heap-based buffer     overflow. NOTE: some of these details are obtained from     third-party information. (CVE-2009-3607)

  - Integer overflow in the ObjectStream::ObjectStream     function in XRef.cc in Xpdf 3.x before 3.02pl4 and     Poppler before 0.12.1, as used in GPdf, kdegraphics     KPDF, CUPS pdftops, and teTeX, might allow remote     attackers to execute arbitrary code via a crafted PDF     document that triggers a heap-based buffer overflow.
    (CVE-2009-3608)

  - Buffer overflow in the ABWOutputDev::endWord function in     poppler/ABWOutputDev.cc in Poppler (aka libpoppler)     0.10.6, 0.12.0, and possibly other versions, as used by     the Abiword pdftoabw utility, allows user-assisted     remote attackers to cause a denial of service and     possibly execute arbitrary code via a crafted PDF file.
    (CVE-2009-3938)

  - A indexing error in FoFiType1::parse() was fixed that     could be used by attackers to corrupt memory and     potentially execute code. (CVE-2009-4035)

This update of libpoppler5 fixes various security issues.

CVE-2009-0791: Fix multiple integer overflows in 'pdftops' filter that could be used by attackers to execute code.

CVE-2009-3607: Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. 

CVE-2009-3608: Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. 

CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file. 

CVE-2009-4035: A indexing error in FoFiType1::parse() was fixed that could be used by attackers to corrupt memory and potentially execute code.

This update of poppler fixes several security issues :

This update of libpoppler4 fixes various security issues.

CVE-2009-0791: Fix multiple integer overflows in 'pdftops' filter that could be used by attackers to execute code.

CVE-2009-3607: Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information. 

CVE-2009-3608: Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. 

CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file. 

CVE-2009-4035: A indexing error in FoFiType1::parse() was fixed that could be used by attackers to corrupt memory and potentially execute code.

This update of libpoppler3 fixes various security issues.

CVE-2009-0791: Fix multiple integer overflows in 'pdftops' filter that could be used by attackers to execute code.

CVE-2009-3607: Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information. 

CVE-2009-3608: Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. 

CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file. 

CVE-2009-4035: A indexing error in FoFiType1::parse() was fixed that could be used by attackers to corrupt memory and potentially execute code.

Updated kdegraphics packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment, including KPDF, a viewer for Portable Document Format (PDF) files.

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in KPDF's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause KPDF to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

An updated gpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GPdf is a viewer for Portable Document Format (PDF) files.

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in GPdf's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause GPdf to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

An updated xpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Xpdf is an X Window System based viewer for Portable Document Format (PDF) files.

Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw in Xpdf's Type 1 font parser. A specially crafted PDF file with an embedded Type 1 font could cause Xpdf to crash or, possibly, execute arbitrary code when opened. (CVE-2009-4035)

Users are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2009:1680 advisory.

    Xpdf is an X Window System based viewer for Portable Document Format (PDF)     files.

    Petr Gajdos and Christian Kornacker of SUSE reported a buffer overflow flaw     in Xpdf's Type 1 font parser. A specially-crafted PDF file with an embedded     Type 1 font could cause Xpdf to crash or, possibly, execute arbitrary code     when opened. (CVE-2009-4035)

    Users are advised to upgrade to this updated package, which contains a     backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
72549	GLSA-201402-17 : Xpdf: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
67978	Oracle Linux 4 : kdegraphics (ELSA-2009-1682)	Nessus	Oracle Linux Local Security Checks	high
67977	Oracle Linux 4 : gpdf (ELSA-2009-1681)	Nessus	Oracle Linux Local Security Checks	high
67976	Oracle Linux 4 : xpdf (ELSA-2009-1680)	Nessus	Oracle Linux Local Security Checks	high
60712	Scientific Linux Security Update : xpdf on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60711	Scientific Linux Security Update : kdegraphics on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60710	Scientific Linux Security Update : gpdf on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
49916	SuSE 10 Security Update : poppler (ZYPP Patch Number 6743)	Nessus	SuSE Local Security Checks	high
43856	openSUSE Security Update : libpoppler-devel (libpoppler-devel-1735)	Nessus	SuSE Local Security Checks	high
43621	SuSE 10 Security Update : poppler (ZYPP Patch Number 6751)	Nessus	SuSE Local Security Checks	high
43620	SuSE 11 Security Update : libpoppler (SAT Patch Number 1731)	Nessus	SuSE Local Security Checks	high
43618	SuSE 11.2 Security Update: libpoppler-devel (2009-12-22)	Nessus	SuSE Local Security Checks	high
43617	openSUSE Security Update : libpoppler-devel (libpoppler-devel-1741)	Nessus	SuSE Local Security Checks	high
43616	openSUSE Security Update : libpoppler-devel (libpoppler-devel-1740)	Nessus	SuSE Local Security Checks	high
43359	CentOS 4 : kdegraphics (CESA-2009:1682)	Nessus	CentOS Local Security Checks	high
43358	CentOS 4 : gpdf (CESA-2009:1681)	Nessus	CentOS Local Security Checks	high
43357	CentOS 4 : xpdf (CESA-2009:1680)	Nessus	CentOS Local Security Checks	high
43180	RHEL 4 : kdegraphics (RHSA-2009:1682)	Nessus	Red Hat Local Security Checks	high
43179	RHEL 4 : gpdf (RHSA-2009:1681)	Nessus	Red Hat Local Security Checks	high
43178	RHEL 4 : xpdf (RHSA-2009:1680)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2009-4035

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical