Executive Summary

Informations
NameCVE-2009-3605First vendor Publication2009-11-02
VendorCveLast vendor Modification2012-01-18

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score6.8Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Security Protection

ImpactsProvides unauthorized access : Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service.

Detail

Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/. NOTE: this may overlap CVE-2009-0791.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3605

CWE : Common Weakness Enumeration

idName
CWE-189Numeric Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:7731
 
Oval ID: oval:org.mitre.oval:def:7731
Title: Multiple Security Vulnerabilities in the Solaris GNOME PDF Rendering Libraries May Lead to a Denial of Service (DoS) or Execution of Arbitrary Code
Description: Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/. NOTE: this may overlap CVE-2009-0791.
Family: unix Class: vulnerability
Reference(s): CVE-2009-3605
Version: 2
Platform(s): Sun Solaris 10
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application48

OpenVAS Exploits

DateDescription
2011-11-18Name : Mandriva Update for poppler MDVSA-2011:175 (poppler)
File : nvt/gb_mandriva_MDVSA_2011_175.nasl
2010-03-12Name : Mandriva Update for poppler MDVSA-2010:055 (poppler)
File : nvt/gb_mandriva_MDVSA_2010_055.nasl
2009-12-30Name : Mandriva Security Advisory MDVSA-2009:334 (poppler)
File : nvt/mdksa_2009_334.nasl
2009-11-23Name : Ubuntu USN-850-3 (poppler)
File : nvt/ubuntu_850_3.nasl
2009-11-11Name : SLES10: Security update for xpdf
File : nvt/sles10_xpdf2.nasl
2009-11-11Name : SuSE Security Summary SUSE-SR:2009:018
File : nvt/suse_sr_2009_018.nasl
2009-10-27Name : Fedora Core 11 FEDORA-2009-10648 (xpdf)
File : nvt/fcore_2009_10648.nasl
2009-10-27Name : Fedora Core 10 FEDORA-2009-10694 (xpdf)
File : nvt/fcore_2009_10694.nasl
2009-10-27Name : Ubuntu USN-850-1 (poppler)
File : nvt/ubuntu_850_1.nasl
2009-10-27Name : Ubuntu USN-850-2 (poppler)
File : nvt/ubuntu_850_2.nasl
0000-00-00Name : Slackware Advisory SSA:2009-302-01 xpdf
File : nvt/esoft_slk_ssa_2009_302_01.nasl
0000-00-00Name : Slackware Advisory SSA:2009-302-02 poppler
File : nvt/esoft_slk_ssa_2009_302_02.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
59825Poppler PDF Handling Multiple Unspecified Overflows

Nessus® Vulnerability Scanner

DateDescription
2013-10-07Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201310-03.nasl - Type : ACT_GATHER_INFO
2010-10-11Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xpdf-6560.nasl - Type : ACT_GATHER_INFO
2010-03-08Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-055.nasl - Type : ACT_GATHER_INFO
2010-02-24Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1941.nasl - Type : ACT_GATHER_INFO
2009-12-30Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2009-346.nasl - Type : ACT_GATHER_INFO
2009-11-09Name : The remote SuSE system is missing a security patch for xpdf
File : suse_11_1_xpdf-091024.nasl - Type : ACT_GATHER_INFO
2009-11-09Name : The remote SuSE system is missing a security patch for xpdf
File : suse_11_0_xpdf-091023.nasl - Type : ACT_GATHER_INFO
2009-11-09Name : The remote SuSE system is missing the security patch xpdf-6558
File : suse_xpdf-6558.nasl - Type : ACT_GATHER_INFO
2009-11-06Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xpdf-6556.nasl - Type : ACT_GATHER_INFO
2009-11-03Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-850-3.nasl - Type : ACT_GATHER_INFO
2009-10-29Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2009-302-01.nasl - Type : ACT_GATHER_INFO
2009-10-29Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2009-302-02.nasl - Type : ACT_GATHER_INFO
2009-10-23Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-850-2.nasl - Type : ACT_GATHER_INFO
2009-10-22Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-850-1.nasl - Type : ACT_GATHER_INFO

Internal Sources (Detail)

SourceUrl
CONFIRMhttp://cgit.freedesktop.org/poppler/poppler/commit/?id=284a92899602daa4a7f429...
http://cgit.freedesktop.org/poppler/poppler/commit/?id=7b2d314a61fd0e12f47c62...
http://cgit.freedesktop.org/poppler/poppler/commit/?id=9cf2325fb22f812b31858e...
https://bugs.launchpad.net/bugs/cve/2009-3605
https://bugzilla.redhat.com/show_bug.cgi?id=491840
https://launchpad.net/ubuntu/+archive/primary/+files/poppler_0.10.5-1ubuntu2....
https://launchpad.net/ubuntu/+archive/primary/+files/poppler_0.8.7-1ubuntu0.4...
MANDRIVAhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:334
http://www.mandriva.com/security/advisories?name=MDVSA-2011:175
SECUNIAhttp://secunia.com/advisories/37114
SUNALERThttp://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1
SUSEhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
UBUNTUhttp://www.ubuntu.com/usn/USN-850-1

Alert History

If you want to see full details history, please login or register.
0
1
DateInformations
2014-02-17 10:51:56
  • Multiple Updates
2013-05-10 23:59:17
  • Multiple Updates