Fluid Attacks Database

Description

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	xpdf	>=0 <3.02-1.4+lenny1	3.02-1.4+lenny1
debian 11	xpdf	>=0 <3.02-1.4+lenny1	3.02-1.4+lenny1
debian 12	xpdf	>=0 <3.02-1.4+lenny1	3.02-1.4+lenny1
debian 13	xpdf	>=0 <3.02-1.4+lenny1	3.02-1.4+lenny1
rpm rhel5	poppler	<0:0.5.4-4.4.el5_3.9	0:0.5.4-4.4.el5_3.9
rpm rhel5	tetex	<0:3.0-33.8.el5_5.5	0:3.0-33.8.el5_5.5
rpm rhel5	kdegraphics	<7:3.5.4-12.el5_3	7:3.5.4-12.el5_3
rpm rhel5	cups	<1:1.3.7-8.el5_3.4	1:1.3.7-8.el5_3.4

Aliases

1. CVE-2009-01952. NVD-2009-01953. OSV-DEBIAN-2009-01954. OSV-2009-01955. SECURITY-TRACKER-CVE-2009-0195

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.