xpdf/poppler: integer overflow in ObjectStream::ObjectStream (oCERT-2009-016)

🗓️ 15 Oct 2009 08:59:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Overflow in ObjectStream constructor can cause heap overflow and code execution via crafted PDF.

Reporter	Title	Published	Views	Family All 264
ALT Linux	Security fix for the ALT Linux 5 package xpdf version 3.02-alt7	15 Nov 200900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 5 package poppler5 version 0.12.1-alt1	19 Oct 200900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 5 package kdegraphics version 3.5.10-alt3	19 Oct 200900:00	–	altlinux
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	6 Jul 201600:00	–	bdu_fstec

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	5	i386	cups	1:1.3.7-11.el5_4.3	cups-1:1.3.7-11.el5_4.3.i386.rpm
Red Hat Enterprise Linux	5	ia64	cups	1:1.3.7-11.el5_4.3	cups-1:1.3.7-11.el5_4.3.ia64.rpm
Red Hat Enterprise Linux	5	ppc	cups	1:1.3.7-11.el5_4.3	cups-1:1.3.7-11.el5_4.3.ppc.rpm
Red Hat Enterprise Linux	5	s390x	cups	1:1.3.7-11.el5_4.3	cups-1:1.3.7-11.el5_4.3.s390x.rpm
Red Hat Enterprise Linux	5	x86_64	cups	1:1.3.7-11.el5_4.3	cups-1:1.3.7-11.el5_4.3.x86_64.rpm
Red Hat Enterprise Linux	5	i386	cups-debuginfo	1:1.3.7-11.el5_4.3	cups-debuginfo-1:1.3.7-11.el5_4.3.i386.rpm
Red Hat Enterprise Linux	5	ia64	cups-debuginfo	1:1.3.7-11.el5_4.3	cups-debuginfo-1:1.3.7-11.el5_4.3.ia64.rpm
Red Hat Enterprise Linux	5	ppc	cups-debuginfo	1:1.3.7-11.el5_4.3	cups-debuginfo-1:1.3.7-11.el5_4.3.ppc.rpm
Red Hat Enterprise Linux	5	ppc64	cups-debuginfo	1:1.3.7-11.el5_4.3	cups-debuginfo-1:1.3.7-11.el5_4.3.ppc64.rpm
Red Hat Enterprise Linux	5	s390	cups-debuginfo	1:1.3.7-11.el5_4.3	cups-debuginfo-1:1.3.7-11.el5_4.3.s390.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2009-3608
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2009-3608
cve	www.cve.org/CVERecord

25 Jun 2026 10:36Current

6.6Medium risk

Vulners AI Score6.6

CVSS 29.3

EPSS0.10228

overflow vulnerability objectstream constructor heap overflow remote code execution crafted document