Fluid Attacks Database

Description

Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	xpdf	>=0 <3.02-2	3.02-2
debian 11	xpdf	>=0 <3.02-2	3.02-2
debian 11	poppler	>=0 <0.10.6-1	0.10.6-1
debian 12	xpdf	>=0 <3.02-2	3.02-2
debian 12	poppler	>=0 <0.10.6-1	0.10.6-1
debian 13	xpdf	>=0 <3.02-2	3.02-2
debian 13	poppler	>=0 <0.10.6-1	0.10.6-1
debian 14	poppler	>=0 <0.10.6-1	0.10.6-1
rpm rhel5	poppler	<0:0.5.4-4.4.el5_3.9	0:0.5.4-4.4.el5_3.9
rpm rhel5	kdegraphics	<7:3.5.4-15.el5_4.2	7:3.5.4-15.el5_4.2

Aliases

1. CVE-2009-11882. NVD-2009-11883. OSV-DEBIAN-2009-11884. OSV-2009-11885. SECURITY-TRACKER-CVE-2009-1188

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.