1. CVE-Search
  2. CVE-2009-3607
ID CVE-2009-3607
Summary Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
References
Vulnerable Configurations
  • cpe:2.3:a:poppler:poppler:0.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.7:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.7:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.11.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.11.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.6:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.6:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.91:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.91:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.4:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.4:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.11.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.11.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.12.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.12.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.6:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.9:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.9:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.90:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.90:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.9.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.9.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.7:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.7:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.11.0:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.11.1:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.11.1:*:*:*:*:*:*:*
  • cpe:2.3:a:poppler:poppler:0.10.5:*:*:*:*:*:*:*
    cpe:2.3:a:poppler:poppler:0.10.5:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 13-02-2023 - 02:20)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
refmap via4
bid 36718
confirm
debian DSA-1941
fedora
  • FEDORA-2009-10823
  • FEDORA-2009-10845
mandriva MDVSA-2011:175
mlist
  • [oss-security] 20091130 Need more information on recent poppler issues
  • [oss-security] 20091130 Re: Need more information on recent poppler issues
  • [oss-security] 20091201 Re: Need more information on recent poppler issues
secunia
  • 37054
  • 37114
  • 37159
sunalert
  • 1021706
  • 274030
ubuntu
  • USN-850-1
  • USN-850-3
vupen ADV-2009-2925
xf poppler-createsurfacefromthumbnaildata-bo(53801)
statements via4
contributor Tomas Hoger
lastmodified 2009-10-23
organization Red Hat
statement Not vulnerable. This issue did not affect the version of poppler as shipped with Red Hat Enterprise Linux 5.
Last major update 13-02-2023 - 02:20
Published 21-10-2009 - 17:30
Last modified 13-02-2023 - 02:20
Back to Top