Vulnerabilities > CVE-2009-3607 - Numeric Errors vulnerability in Poppler
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2009-10845.NASL description This build addresses several recent security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 42280 published 2009-10-28 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/42280 title Fedora 11 : poppler-0.10.7-3.fc11 (2009-10845) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2009-10845. # include("compat.inc"); if (description) { script_id(42280); script_version("1.13"); script_cvs_date("Date: 2019/08/02 13:32:29"); script_cve_id("CVE-2009-3603", "CVE-2009-3604", "CVE-2009-3606", "CVE-2009-3607", "CVE-2009-3608", "CVE-2009-3609"); script_bugtraq_id(36703, 36718); script_xref(name:"FEDORA", value:"2009-10845"); script_name(english:"Fedora 11 : poppler-0.10.7-3.fc11 (2009-10845)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora host is missing a security update." ); script_set_attribute( attribute:"description", value: "This build addresses several recent security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=526637" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=526877" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=526893" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=526911" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=526915" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=526924" ); # https://lists.fedoraproject.org/pipermail/package-announce/2009-October/030415.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?40b9b183" ); script_set_attribute( attribute:"solution", value:"Update the affected poppler package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(189, 399); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:poppler"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:11"); script_set_attribute(attribute:"patch_publication_date", value:"2009/10/27"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/10/28"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^11([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 11.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC11", reference:"poppler-0.10.7-3.fc11")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "poppler"); }
NASL family SuSE Local Security Checks NASL id SUSE_11_2_LIBPOPPLER-DEVEL-100111.NASL description This update of libpoppler5 fixes various security issues. CVE-2009-0791: Fix multiple integer overflows in last seen 2020-06-01 modified 2020-06-02 plugin id 43856 published 2010-01-12 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43856 title openSUSE Security Update : libpoppler-devel (libpoppler-devel-1735) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from openSUSE Security Update libpoppler-devel-1735. # # The text description of this plugin is (C) SUSE LLC. # include("compat.inc"); if (description) { script_id(43856); script_version("1.9"); script_cvs_date("Date: 2019/10/25 13:36:38"); script_cve_id("CVE-2009-0791", "CVE-2009-3607", "CVE-2009-3608", "CVE-2009-3938", "CVE-2009-4035"); script_name(english:"openSUSE Security Update : libpoppler-devel (libpoppler-devel-1735)"); script_summary(english:"Check for the libpoppler-devel-1735 patch"); script_set_attribute( attribute:"synopsis", value:"The remote openSUSE host is missing a security update." ); script_set_attribute( attribute:"description", value: "This update of libpoppler5 fixes various security issues. CVE-2009-0791: Fix multiple integer overflows in 'pdftops' filter that could be used by attackers to execute code. CVE-2009-3607: Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information. CVE-2009-3608: Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file. CVE-2009-4035: A indexing error in FoFiType1::parse() was fixed that could be used by attackers to corrupt memory and potentially execute code." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=507102" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=537171" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=543090" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=546393" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=556607" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.novell.com/show_bug.cgi?id=556876" ); script_set_attribute( attribute:"solution", value:"Update the affected libpoppler-devel packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(94, 119, 189); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler-glib-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler-glib4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler-qt2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler-qt3-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler-qt4-3"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler-qt4-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libpoppler5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:poppler-tools"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:11.2"); script_set_attribute(attribute:"patch_publication_date", value:"2010/01/11"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/12"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE"); if (release !~ "^(SUSE11\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "11.2", release); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); ourarch = get_kb_item("Host/cpu"); if (!ourarch) audit(AUDIT_UNKNOWN_ARCH); if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch); flag = 0; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler-devel-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler-glib-devel-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler-glib4-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler-qt2-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler-qt3-devel-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler-qt4-3-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler-qt4-devel-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"libpoppler5-0.12.0-3.7.1") ) flag++; if ( rpm_check(release:"SUSE11.2", reference:"poppler-tools-0.12.0-3.7.1") ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libpoppler5"); }
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201310-03.NASL description The remote host is affected by the vulnerability described in GLSA-201310-03 (Poppler: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted PDF file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 70309 published 2013-10-07 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/70309 title GLSA-201310-03 : Poppler: Multiple vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_11_LIBPOPPLER-DEVEL-091221.NASL description This update of libpoppler4 fixes various security issues. - Fix multiple integer overflows in last seen 2020-06-01 modified 2020-06-02 plugin id 43620 published 2010-01-03 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43620 title SuSE 11 Security Update : libpoppler (SAT Patch Number 1731) NASL family SuSE Local Security Checks NASL id SUSE_11_0_LIBPOPPLER-DEVEL-091223.NASL description This update of libpoppler3 fixes various security issues. CVE-2009-0791: Fix multiple integer overflows in last seen 2020-06-01 modified 2020-06-02 plugin id 43616 published 2010-01-03 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43616 title openSUSE Security Update : libpoppler-devel (libpoppler-devel-1740) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1941.NASL description Several integer overflows, buffer overflows and memory allocation errors were discovered in the Poppler PDF rendering library, which may lead to denial of service or the execution of arbitrary code if a user is tricked into opening a malformed PDF document. An update for the old stable distribution (etch) will be issued soon as version 0.4.5-5.1etch4. last seen 2020-06-01 modified 2020-06-02 plugin id 44806 published 2010-02-24 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/44806 title Debian DSA-1941-1 : poppler - several vulnerabilities NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2010-055.NASL description An out-of-bounds reading flaw in the JBIG2 decoder allows remote attackers to cause a denial of service (crash) via a crafted PDF file (CVE-2009-0799). Multiple input validation flaws in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF file (CVE-2009-0800). An integer overflow in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF file (CVE-2009-1179). A free of invalid data flaw in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF (CVE-2009-1180). A NULL pointer dereference flaw in the JBIG2 decoder allows remote attackers to cause denial of service (crash) via a crafted PDF file (CVE-2009-1181). Multiple buffer overflows in the JBIG2 MMR decoder allows remote attackers to cause denial of service or to execute arbitrary code via a crafted PDF file (CVE-2009-1182, CVE-2009-1183). An integer overflow in the JBIG2 decoding feature allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CVE-2009-1187). An integer overflow in the JBIG2 decoding feature allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document (CVE-2009-1188). Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188 (CVE-2009-3603). The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow (CVE-2009-3604). Multiple integer overflows allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/. NOTE: this may overlap CVE-2009-0791 (CVE-2009-3605). Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow (CVE-2009-3606). Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third-party information (CVE-2009-3607). Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow (CVE-2009-3608). Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read (CVE-2009-3609). Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file (CVE-2009-3938). This update provides fixes for that vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 44995 published 2010-03-08 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44995 title Mandriva Linux Security Advisory : poppler (MDVSA-2010:055) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-850-1.NASL description It was discovered that poppler contained multiple security issues when parsing malformed PDF documents. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 42207 published 2009-10-22 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42207 title Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : poppler vulnerabilities (USN-850-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-1504.NASL description Updated poppler packages that fix multiple security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-3603, CVE-2009-3608, CVE-2009-3609) Red Hat would like to thank Chris Rohlf for reporting the CVE-2009-3608 issue. This update also corrects a regression introduced in the previous poppler security update, RHSA-2009:0480, that prevented poppler from rendering certain PDF documents correctly. (BZ#528147) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 43804 published 2010-01-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43804 title CentOS 5 : poppler (CESA-2009:1504) NASL family SuSE Local Security Checks NASL id SUSE_11_1_LIBPOPPLER-DEVEL-091222.NASL description This update of poppler fixes several security issues : This update of libpoppler4 fixes various security issues. CVE-2009-0791: Fix multiple integer overflows in last seen 2020-06-01 modified 2020-06-02 plugin id 43617 published 2010-01-03 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43617 title openSUSE Security Update : libpoppler-devel (libpoppler-devel-1741) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-1504.NASL description Updated poppler packages that fix multiple security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-3603, CVE-2009-3608, CVE-2009-3609) Red Hat would like to thank Chris Rohlf for reporting the CVE-2009-3608 issue. This update also corrects a regression introduced in the previous poppler security update, RHSA-2009:0480, that prevented poppler from rendering certain PDF documents correctly. (BZ#528147) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 42163 published 2009-10-16 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42163 title RHEL 5 : poppler (RHSA-2009:1504) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-1504.NASL description From Red Hat Security Advisory 2009:1504 : Updated poppler packages that fix multiple security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-3603, CVE-2009-3608, CVE-2009-3609) Red Hat would like to thank Chris Rohlf for reporting the CVE-2009-3608 issue. This update also corrects a regression introduced in the previous poppler security update, RHSA-2009:0480, that prevented poppler from rendering certain PDF documents correctly. (BZ#528147) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67942 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67942 title Oracle Linux 5 : poppler (ELSA-2009-1504) NASL family SuSE Local Security Checks NASL id SUSE_11_2_LIBPOPPLER-DEVEL-091222.NASL description This update of libpoppler5 fixes various security issues. CVE-2009-0791: Fix multiple integer overflows in last seen 2020-06-01 modified 2020-06-02 plugin id 43618 published 2010-01-03 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/43618 title SuSE 11.2 Security Update: libpoppler-devel (2009-12-22) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-850-3.NASL description USN-850-1 fixed vulnerabilities in poppler. This update provides the corresponding updates for Ubuntu 9.10. It was discovered that poppler contained multiple security issues when parsing malformed PDF documents. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 42344 published 2009-11-03 reporter Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/42344 title Ubuntu 9.10 : poppler vulnerabilities (USN-850-3) NASL family Fedora Local Security Checks NASL id FEDORA_2009-10823.NASL description This build addresses several recent security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 42279 published 2009-10-28 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/42279 title Fedora 10 : poppler-0.8.7-7.fc10 (2009-10823)
Seebug
bulletinFamily | exploit |
description | Bugraq ID: 36718 CVE ID:CVE-2009-3607 Poppler是一款用来生成PDF 的C++类库,从xpdf继承而来。 Poppler create_surface_from_thumbnail_data()函数存在整数溢出,cairo_pixels缓冲区分配如下: cairo_pixels = (guchar *)g_malloc (4 * width * height); 其中width / height值从PDF文件中读取,Page::loadThumb()函数对值进行了一些验证,但是不能充分的防止溢出: if (width > INT_MAX / 3 / height) Poppler poppler 0.12 Poppler poppler 0.10.6 Poppler poppler 0.10.4 Poppler poppler 0.10.3 Poppler poppler 0.8.4 Poppler poppler 0.8 Poppler poppler 0.5.4 Poppler poppler 0.5.3 Poppler poppler 0.5.1 Poppler poppler 0.4.5 Poppler poppler 0.4.2 Poppler poppler 0.4.1 Poppler poppler 0.3.2 目前没有详细解决方案提供: http://poppler.freedesktop.org/ |
id | SSV:12494 |
last seen | 2017-11-19 |
modified | 2009-10-20 |
published | 2009-10-20 |
reporter | Root |
title | Poppler 'create_surface_from_thumbnail_data()'整数溢出漏洞 |
Statements
contributor | Tomas Hoger |
lastmodified | 2009-10-23 |
organization | Red Hat |
statement | Not vulnerable. This issue did not affect the version of poppler as shipped with Red Hat Enterprise Linux 5. |
References
- http://www.vupen.com/english/advisories/2009/2925
- http://www.securityfocus.com/bid/36718
- http://cgit.freedesktop.org/poppler/poppler/commit/?id=c839b706
- https://bugzilla.redhat.com/show_bug.cgi?id=526924
- http://secunia.com/advisories/37054
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00784.html
- http://secunia.com/advisories/37159
- https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00750.html
- http://www.ubuntu.com/usn/USN-850-1
- http://secunia.com/advisories/37114
- http://www.openwall.com/lists/oss-security/2009/12/01/5
- http://www.openwall.com/lists/oss-security/2009/12/01/6
- http://www.debian.org/security/2009/dsa-1941
- http://www.openwall.com/lists/oss-security/2009/12/01/1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1
- http://www.ubuntu.com/usn/USN-850-3
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:175
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53801