Debian Security Bug TrackerDEBIANCVE:CVE-2009-4035CVE-2009-4035
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.007 Low
EPSS
Percentile
80.1%
The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | poppler | < 0.5.1-1 | poppler_0.5.1-1_all.deb |
| Debian | 11 | all | poppler | < 0.5.1-1 | poppler_0.5.1-1_all.deb |
| Debian | 10 | all | poppler | < 0.5.1-1 | poppler_0.5.1-1_all.deb |
| Debian | 999 | all | poppler | < 0.5.1-1 | poppler_0.5.1-1_all.deb |
| Debian | 13 | all | poppler | < 0.5.1-1 | poppler_0.5.1-1_all.deb |
| Debian | 12 | all | xpdf | < 3.01-1 | xpdf_3.01-1_all.deb |
| Debian | 11 | all | xpdf | < 3.01-1 | xpdf_3.01-1_all.deb |
| Debian | 10 | all | xpdf | < 3.01-1 | xpdf_3.01-1_all.deb |
| Debian | 999 | all | xpdf | < 3.01-1 | xpdf_3.01-1_all.deb |
| Debian | 13 | all | xpdf | < 3.01-1 | xpdf_3.01-1_all.deb |
Related
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.007 Low
EPSS
Percentile
80.1%