The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-416:01 advisory.

    The KDE Graphics is a metapackage  of graphics related applications and libraries for use with the K     Desktop Environment.
    Security bugs fixed with this release:
    CVE-2009-0146     Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
    CVE-2009-0147     Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3)     JBIG2Stream::readGenericBitmap.
    CVE-2009-0166     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote     attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of     uninitialized memory.
    CVE-2009-0195     Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows     remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.
    CVE-2009-0791     Multiple integer overflows in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7 allow remote attackers     to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file     that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3)     gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may     overlap CVE-2009-1179.
    CVE-2009-0799     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers     an out-of-bounds read.
    CVE-2009-0800     Multiple input validation flaws in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1179     Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before     0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
    CVE-2009-1180     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of     invalid data.
    CVE-2009-1181     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers     a NULL pointer dereference.
    CVE-2009-1182     Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1183     The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and     other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted     PDF file.
    CVE-2009-1188     Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary code via vectors related to SplashBitmap     (splash/SplashBitmap.cc).
    CVE-2009-3604     CVE-2009-3606     CVE-2009-3608     CVE-2009-3609     No description available at the time of writing. Please refer to the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-56:01 advisory.

    Poppler, a PDF rendering library, it's a fork of the xpdf PDF viewer developed by Derek Noonburg of Glyph     and Cog, LLC.
    Fixed bugs:
    CVE-2009-0146     Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
    CVE-2009-0147     Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3)     JBIG2Stream::readGenericBitmap.
    CVE-2009-0166     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote     attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of     uninitialized memory.
    CVE-2009-0195     Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows     remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.
    CVE-2009-0799     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers     an out-of-bounds read.
    CVE-2009-0800     Multiple input validation flaws in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1179     Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before     0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
    CVE-2009-1180     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of     invalid data.
    CVE-2009-1181     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial ofservice (crash) via a crafted PDF file that triggers     a NULL pointer dereference.
    CVE-2009-1182     Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier,CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1183     The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and     other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted     PDF file.
    CVE-2009-1187     Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev     (CairoOutputDev.cc).
    CVE-2009-1188     Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary code via vectors related to SplashBitmap     (splash/SplashBitmap.cc).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fix several security updates in xpdf (3.02pl3 patch applied).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Will Dormann, Alin Rad Pop, Braden Thomas, and Drew Yao discovered that poppler contained multiple security issues in its JBIG2 decoder.
If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security problems while decoding JBIG2.
(CVE-2009-0146 / CVE-2009-0147 / CVE-2009-0165 / CVE-2009-0166 / CVE-2009-0799 / CVE-2009-0800 / CVE-2009-1179 / CVE-2009-1180 / CVE-2009-1181 / CVE-2009-1182 / CVE-2009-1183)

Updated poppler packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188)

Multiple buffer overflow flaws were found in poppler's JBIG2 decoder.
An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0146, CVE-2009-1182)

Multiple flaws were found in poppler's JBIG2 decoder that could lead to the freeing of arbitrary memory. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0166, CVE-2009-1180)

Multiple input validation flaws were found in poppler's JBIG2 decoder.
An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0800)

Multiple denial of service flaws were found in poppler's JBIG2 decoder. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash when opened. (CVE-2009-0799, CVE-2009-1181, CVE-2009-1183)

Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team, and Will Dormann of the CERT/CC for responsibly reporting these flaws.

Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

This update of poppler: fix various security bugs that occur while decoding JBIG2 (CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0166, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181, CVE-2009-1182, CVE-2009-1183).

Further a denial of service bug in function FormWidgetChoice::loadDefaults() (CVE-2009-0755) and JBIG2Stream::readSymbolDictSeg() (CVE-2009-0756) was closed that could be triggered via malformed PDF files.

Multiple integer overflow flaws were found in KPDF's JBIG2 decoder. An attacker could create a malicious PDF file that would cause KPDF to crash or, potentially, execute arbitrary code when opened.
(CVE-2009-0147, CVE-2009-1179)

Multiple buffer overflow flaws were found in KPDF's JBIG2 decoder. An attacker could create a malicious PDF file that would cause KPDF to crash or, potentially, execute arbitrary code when opened.
(CVE-2009-0146, CVE-2009-1182)

Multiple flaws were found in KPDF's JBIG2 decoder that could lead to the freeing of arbitrary memory. An attacker could create a malicious PDF file that would cause KPDF to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0166, CVE-2009-1180)

Multiple input validation flaws were found in KPDF's JBIG2 decoder. An attacker could create a malicious PDF file that would cause KPDF to crash or, potentially, execute arbitrary code when opened.
(CVE-2009-0800)

Multiple denial of service flaws were found in KPDF's JBIG2 decoder.
An attacker could create a malicious PDF that would cause KPDF to crash when opened. (CVE-2009-0799, CVE-2009-1181, CVE-2009-1183)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0429 advisory.

    [1:1.3.7-8:.4]
    - Applied additional patches by Tim Waugh for batch3892.pdf,       batch4781.pdf, batch5486.pdf, batch19856.pdf, batch19869.pdf       testing files from CERT (bug #491864).
    - Resolves: rhbz#492386.

    [1:1.3.7-8:.3]
    - Applied patches to fix CVE-2009-0163 (bug #490596),       CVE-2009-0146 (bug #490612), CVE-2009-0147 (bug #490614),       and CVE-2009-0166 (bug #490625).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188)

Multiple buffer overflow flaws were found in poppler's JBIG2 decoder.
An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0146, CVE-2009-1182)

Multiple flaws were found in poppler's JBIG2 decoder that could lead to the freeing of arbitrary memory. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0166, CVE-2009-1180)

Multiple input validation flaws were found in poppler's JBIG2 decoder.
An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0800)

Multiple denial of service flaws were found in poppler's JBIG2 decoder. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash when opened. (CVE-2009-0799, CVE-2009-1181, CVE-2009-1183)

New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201310-03 (Poppler: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Poppler. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted PDF       file, possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
284032	MiracleLinux 3 : kdegraphics-3.5.5-3.5AXS3 (AXSA:2009-416:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium
284379	MiracleLinux 3 : poppler-0.5.4-4.4.9.1AXS3 (AXSA:2009-56:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium
36210	Fedora 9 : xpdf-3.02-13.fc9 (2009-3794)	Nessus	Fedora Local Security Checks	4/22/2009	1/11/2021	high
36635	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 : poppler vulnerabilities (USN-759-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	high
41530	SuSE 10 Security Update : kdegraphics3 (ZYPP Patch Number 6283)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
38769	RHEL 5 : poppler (RHSA-2009:0480)	Nessus	Red Hat Local Security Checks	5/14/2009	1/14/2021	high
40042	openSUSE Security Update : libpoppler3 (libpoppler3-1035)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	critical
42030	openSUSE 10 Security Update : poppler (poppler-6319)	Nessus	SuSE Local Security Checks	10/6/2009	1/14/2021	critical
60569	Scientific Linux Security Update : kdegraphics on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
67844	Oracle Linux 5 : cups (ELSA-2009-0429)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	medium
60584	Scientific Linux Security Update : poppler on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
38720	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 9.1 / current : xpdf (SSA:2009-129-01)	Nessus	Slackware Local Security Checks	5/11/2009	1/14/2021	critical
70309	GLSA-201310-03 : Poppler: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	10/7/2013	1/6/2021	high

Detections

Analytics

Plugins Search

medium

medium

high

high

critical

high

critical

critical

high

medium

high

critical

high