Vulnerabilities > CVE-2009-1187 - Numeric Errors vulnerability in Poppler
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc).
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201310-03.NASL description The remote host is affected by the vulnerability described in GLSA-201310-03 (Poppler: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted PDF file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 70309 published 2013-10-07 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70309 title GLSA-201310-03 : Poppler: Multiple vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-759-1.NASL description Will Dormann, Alin Rad Pop, Braden Thomas, and Drew Yao discovered that poppler contained multiple security issues in its JBIG2 decoder. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 36635 published 2009-04-23 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/36635 title Ubuntu 6.06 LTS / 8.04 LTS / 8.10 : poppler vulnerabilities (USN-759-1) NASL family Fedora Local Security Checks NASL id FEDORA_2009-6973.NASL description An update to address jbig2-related security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 39547 published 2009-06-28 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/39547 title Fedora 10 : poppler-0.8.7-6.fc10 (2009-6973) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2010-055.NASL description An out-of-bounds reading flaw in the JBIG2 decoder allows remote attackers to cause a denial of service (crash) via a crafted PDF file (CVE-2009-0799). Multiple input validation flaws in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF file (CVE-2009-0800). An integer overflow in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF file (CVE-2009-1179). A free of invalid data flaw in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF (CVE-2009-1180). A NULL pointer dereference flaw in the JBIG2 decoder allows remote attackers to cause denial of service (crash) via a crafted PDF file (CVE-2009-1181). Multiple buffer overflows in the JBIG2 MMR decoder allows remote attackers to cause denial of service or to execute arbitrary code via a crafted PDF file (CVE-2009-1182, CVE-2009-1183). An integer overflow in the JBIG2 decoding feature allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CVE-2009-1187). An integer overflow in the JBIG2 decoding feature allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document (CVE-2009-1188). Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188 (CVE-2009-3603). The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow (CVE-2009-3604). Multiple integer overflows allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/. NOTE: this may overlap CVE-2009-0791 (CVE-2009-3605). Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow (CVE-2009-3606). Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information (CVE-2009-3607). Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow (CVE-2009-3608). Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read (CVE-2009-3609). Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file (CVE-2009-3938). This update provides fixes for that vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 44995 published 2010-03-08 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44995 title Mandriva Linux Security Advisory : poppler (MDVSA-2010:055) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-0480.NASL description Updated poppler packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188) Multiple buffer overflow flaws were found in poppler last seen 2020-06-01 modified 2020-06-02 plugin id 38769 published 2009-05-14 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38769 title RHEL 5 : poppler (RHSA-2009:0480) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-0480.NASL description Updated poppler packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188) Multiple buffer overflow flaws were found in poppler last seen 2020-06-01 modified 2020-06-02 plugin id 43748 published 2010-01-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43748 title CentOS 5 : poppler (CESA-2009:0480) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-0480.NASL description From Red Hat Security Advisory 2009:0480 : Updated poppler packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188) Multiple buffer overflow flaws were found in poppler last seen 2020-06-01 modified 2020-06-02 plugin id 67858 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67858 title Oracle Linux 5 : poppler (ELSA-2009-0480) NASL family Scientific Linux Local Security Checks NASL id SL_20090513_POPPLER_ON_SL5_X.NASL description Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188) Multiple buffer overflow flaws were found in poppler last seen 2020-06-01 modified 2020-06-02 plugin id 60584 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60584 title Scientific Linux Security Update : poppler on SL5.x i386/x86_64 NASL family Fedora Local Security Checks NASL id FEDORA_2009-6982.NASL description An update to address jbig2-related security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 39548 published 2009-06-28 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/39548 title Fedora 9 : poppler-0.8.7-2.fc9 (2009-6982) NASL family Fedora Local Security Checks NASL id FEDORA_2009-6972.NASL description An update to the latest stable upstream release fixing many bugs, as well as addressing several security issues. Release announcement, http://lists.freedesktop.org/archives/poppler/2009-May/004721.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 39844 published 2009-07-17 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/39844 title Fedora 11 : poppler-0.10.7-2.fc11 (2009-6972)
Oval
| accepted | 2013-04-29T04:04:21.754-04:00 | ||||||||||||
| class | vulnerability | ||||||||||||
| contributors |
| ||||||||||||
| definition_extensions |
| ||||||||||||
| description | Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc). | ||||||||||||
| family | unix | ||||||||||||
| id | oval:org.mitre.oval:def:10292 | ||||||||||||
| status | accepted | ||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||
| title | Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc). | ||||||||||||
| version | 18 |
Redhat
| advisories |
| ||||
| rpms |
|
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 34568 CVE(CAN) ID: CVE-2009-0146,CVE-2009-0147,CVE-2009-0166,CVE-2009-0799,CVE-2009-0800,CVE-2009-1179,CVE-2009-1180,CVE-2009-1181,CVE-2009-1182,CVE-2009-1183,CVE-2009-1187,CVE-2009-1188 Xpdf是便携文档格式（PDF）文件的开放源码查看器。 Xpdf的JBIG2解码器中存在多个整数溢出、缓冲区溢出、空指针引用和死循环漏洞。攻击者可以创建恶意的PDF文件，如果打开了该文件就会导致Xpdf崩溃或执行任意代码。 Xpdf Xpdf 3.x Xpdf Xpdf 2.x RedHat ------ RedHat已经为此发布了一个安全公告（RHSA-2009:0429-01）以及相应补丁: RHSA-2009:0429-01：Important: cups security update 链接：<a href=https://www.redhat.com/support/errata/RHSA-2009-0429.html target=_blank rel=external nofollow>https://www.redhat.com/support/errata/RHSA-2009-0429.html</a> Xpdf ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl3.patch target=_blank rel=external nofollow>ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl3.patch</a> |
| id | SSV:5067 |
| last seen | 2017-11-19 |
| modified | 2009-04-18 |
| published | 2009-04-18 |
| reporter | Root |
| title | Xpdf JBIG2处理多个缓冲区溢出和拒绝服务漏洞 |
References
- https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/361875
- http://bugs.gentoo.org/show_bug.cgi?id=263028#c16
- http://www.securityfocus.com/bid/34568
- http://www.vupen.com/english/advisories/2009/1076
- http://poppler.freedesktop.org/releases.html
- http://wiki.rpath.com/Advisories:rPSA-2009-0059
- http://secunia.com/advisories/34746
- http://www.kb.cert.org/vuls/id/196617
- http://www.redhat.com/support/errata/RHSA-2009-0480.html
- http://secunia.com/advisories/35064
- http://secunia.com/advisories/35618
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01291.html
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01277.html
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00567.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:087
- http://www.vupen.com/english/advisories/2010/1040
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:175
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50184
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10292
- http://www.securityfocus.com/archive/1/502761/100/0/threaded