DSA-2028

Executive Summary

Summary
Title	New xpdf packages fix several vulnerabilities

Informations
Name	DSA-2028	First vendor Publication	2010-04-05
Vendor	Debian	Last vendor Modification	2010-04-05
Severity (Vendor)	N/A	Revision	1

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Several vulnerabilities have been identified in xpdf, a suite of tools for viewing and converting Portable Document Format (PDF) files.

The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2009-1188 and CVE-2009-3603

Integer overflow in SplashBitmap::SplashBitmap which might allow remote attackers to execute arbitrary code or an application crash via a crafted PDF document.

CVE-2009-3604

NULL pointer dereference or heap-based buffer overflow in Splash::drawImage which might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.

CVE-2009-3606

Integer overflow in the PSOutputDev::doImageL1Sep which might allow remote attackers to execute arbitrary code via a crafted PDF document.

CVE-2009-3608

Integer overflow in the ObjectStream::ObjectStream which might allow remote attackers to execute arbitrary code via a crafted PDF document.

CVE-2009-3609

Integer overflow in the ImageStream::ImageStream which might allow remote attackers to cause a denial of service via a crafted PDF document.

For the stable distribution (lenny), this problem has been fixed in version 3.02-1.4+lenny2.

For the testing distribution (squeeze), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in version 3.02-2.

Original Source

Url : http://www.debian.org/security/2010/dsa-2028

CWE : Common Weakness Enumeration

id	Name
CWE-189	Numeric Errors
CWE-399	Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9957

Oval ID:	oval:org.mitre.oval:def:9957
Title:	Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
Description:	Integer overflow in the JBIG2 decoding feature in the SplashBitmap::SplashBitmap function in SplashBitmap.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.10.6, as used in GPdf and kdegraphics KPDF, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-1188	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section kdegraphics-devel is earlier than 7:3.3.1-15.el4_8.2 AND gpdf is earlier than 0:2.8.2-7.7.2.el4_8.5 AND xpdf is earlier than 1:3.00-22.el4_8.1 AND kdegraphics is earlier than 7:3.3.1-15.el4_8.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section kdegraphics-devel is earlier than 7:3.5.4-15.el5_4.2 AND poppler-utils is earlier than 0:0.5.4-4.4.el5_3.9 AND poppler-devel is earlier than 0:0.5.4-4.4.el5_3.9 AND kdegraphics is earlier than 7:3.5.4-15.el5_4.2 AND poppler is earlier than 0:0.5.4-4.4.el5_3.9

Definition Id: oval:org.mitre.oval:def:9671

Oval ID:	oval:org.mitre.oval:def:9671
Title:	Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188.
Description:	Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3603	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section poppler-utils is earlier than 0:0.5.4-4.4.el5_4.11 AND poppler-devel is earlier than 0:0.5.4-4.4.el5_4.11 AND poppler is earlier than 0:0.5.4-4.4.el5_4.11

Definition Id: oval:org.mitre.oval:def:10969

Oval ID:	oval:org.mitre.oval:def:10969
Title:	The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Description:	The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3604	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND xpdf is earlier than 1:2.02-17.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section kdegraphics-devel is earlier than 7:3.3.1-15.el4_8.2 AND gpdf is earlier than 0:2.8.2-7.7.2.el4_8.5 AND xpdf is earlier than 1:3.00-22.el4_8.1 AND kdegraphics is earlier than 7:3.3.1-15.el4_8.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section kdegraphics-devel is earlier than 7:3.5.4-15.el5_4.2 AND poppler-utils is earlier than 0:0.5.4-4.4.el5_3.9 AND poppler-devel is earlier than 0:0.5.4-4.4.el5_3.9 AND kdegraphics is earlier than 7:3.5.4-15.el5_4.2 AND poppler is earlier than 0:0.5.4-4.4.el5_3.9

Definition Id: oval:org.mitre.oval:def:7836

Oval ID:	oval:org.mitre.oval:def:7836
Title:	Multiple Security Vulnerabilities in the Solaris GNOME PDF Rendering Libraries May Lead to a Denial of Service (DoS) or Execution of Arbitrary Code
Description:	Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3606	Version:	2
Platform(s):	Sun Solaris 10	Product(s):
Definition Synopsis:
Solaris 10 (SPARC) meets Sun Alert 274030 Solaris 10 (SPARC) is installed AND NOT Patch 120739-06 or later installed OR Solaris 10 (x86) meets Sun Alert 274030 Solaris 10 (x86) is installed AND NOT Patch 120740-06 or later installed

Definition Id: oval:org.mitre.oval:def:11289

Oval ID:	oval:org.mitre.oval:def:11289
Title:	Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Description:	Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3606	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND xpdf is earlier than 1:2.02-17.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section gpdf is earlier than 0:2.8.2-7.7.2.el4_7.4 AND xpdf is earlier than 1:3.00-22.el4_8.1 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section kdegraphics-devel is earlier than 7:3.5.4-15.el5_4.2 AND poppler-utils is earlier than 0:0.5.4-4.4.el5_3.9 AND poppler-devel is earlier than 0:0.5.4-4.4.el5_3.9 AND kdegraphics is earlier than 7:3.5.4-15.el5_4.2 AND poppler is earlier than 0:0.5.4-4.4.el5_3.9

Definition Id: oval:org.mitre.oval:def:9536

Oval ID:	oval:org.mitre.oval:def:9536
Title:	Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Description:	Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3608	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section kdegraphics-devel is earlier than 7:3.3.1-15.el4_8.2 AND gpdf is earlier than 0:2.8.2-7.7.2.el4_8.5 AND xpdf is earlier than 1:3.00-22.el4_8.1 AND kdegraphics is earlier than 7:3.3.1-15.el4_8.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section kdegraphics-devel is earlier than 7:3.5.4-15.el5_4.2 AND cups-lpd is earlier than 1:1.3.7-11.el5_4.3 AND tetex-dvips is earlier than 0:3.0-33.8.el5_5.5 AND kdegraphics is earlier than 7:3.5.4-15.el5_4.2 AND poppler is earlier than 0:0.5.4-4.4.el5_4.11 AND tetex-fonts is earlier than 0:3.0-33.8.el5_5.5 AND cups-libs is earlier than 1:1.3.7-11.el5_4.3 AND tetex is earlier than 0:3.0-33.8.el5_5.5 AND tetex-doc is earlier than 0:3.0-33.8.el5_5.5 AND poppler-devel is earlier than 0:0.5.4-4.4.el5_4.11 AND tetex-latex is earlier than 0:3.0-33.8.el5_5.5 AND poppler-utils is earlier than 0:0.5.4-4.4.el5_4.11 AND cups-devel is earlier than 1:1.3.7-11.el5_4.3 AND tetex-afm is earlier than 0:3.0-33.8.el5_5.5 AND tetex-xdvi is earlier than 0:3.0-33.8.el5_5.5 AND cups is earlier than 1:1.3.7-11.el5_4.3

Definition Id: oval:org.mitre.oval:def:8134

Oval ID:	oval:org.mitre.oval:def:8134
Title:	Multiple Security Vulnerabilities in the Solaris GNOME PDF Rendering Libraries May Lead to a Denial of Service (DoS) or Execution of Arbitrary Code
Description:	Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3609	Version:	2
Platform(s):	Sun Solaris 10	Product(s):
Definition Synopsis:
Solaris 10 (SPARC) meets Sun Alert 274030 Solaris 10 (SPARC) is installed AND NOT Patch 120739-06 or later installed OR Solaris 10 (x86) meets Sun Alert 274030 Solaris 10 (x86) is installed AND NOT Patch 120740-06 or later installed

Definition Id: oval:org.mitre.oval:def:11043

Oval ID:	oval:org.mitre.oval:def:11043
Title:	Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.
Description:	Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-3609	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section tetex-latex is earlier than 0:1.0.7-67.19 AND tetex-dvips is earlier than 0:1.0.7-67.19 AND tetex-fonts is earlier than 0:1.0.7-67.19 AND tetex is earlier than 0:1.0.7-67.19 AND tetex-afm is earlier than 0:1.0.7-67.19 AND tetex-doc is earlier than 0:1.0.7-67.19 AND tetex-xdvi is earlier than 0:1.0.7-67.19 AND xpdf is earlier than 1:2.02-17.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.16 AND kdegraphics-devel is earlier than 7:3.3.1-15.el4_8.2 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.16 AND kdegraphics is earlier than 7:3.3.1-15.el4_8.2 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.16 AND gpdf is earlier than 0:2.8.2-7.7.2.el4_8.5 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.16 AND xpdf is earlier than 1:3.00-22.el4_8.1 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.16 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section kdegraphics-devel is earlier than 7:3.5.4-15.el5_4.2 AND cups-lpd is earlier than 1:1.3.7-11.el5_4.3 AND tetex-dvips is earlier than 0:3.0-33.8.el5_5.5 AND kdegraphics is earlier than 7:3.5.4-15.el5_4.2 AND poppler is earlier than 0:0.5.4-4.4.el5_4.11 AND tetex-fonts is earlier than 0:3.0-33.8.el5_5.5 AND cups-libs is earlier than 1:1.3.7-11.el5_4.3 AND tetex is earlier than 0:3.0-33.8.el5_5.5 AND tetex-doc is earlier than 0:3.0-33.8.el5_5.5 AND poppler-devel is earlier than 0:0.5.4-4.4.el5_4.11 AND tetex-latex is earlier than 0:3.0-33.8.el5_5.5 AND poppler-utils is earlier than 0:0.5.4-4.4.el5_4.11 AND cups-devel is earlier than 1:1.3.7-11.el5_4.3 AND tetex-afm is earlier than 0:3.0-33.8.el5_5.5 AND tetex-xdvi is earlier than 0:3.0-33.8.el5_5.5 AND cups is earlier than 1:1.3.7-11.el5_4.3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Foolabs Xpdf cpe:/a:foolabs:xpdf:3.02pl3 cpe:/a:foolabs:xpdf:3.02pl2 cpe:/a:foolabs:xpdf:3.02pl1 cpe:/a:foolabs:xpdf:3.02 cpe:/a:foolabs:xpdf:3.01 cpe:/a:foolabs:xpdf:3.00 cpe:/a:foolabs:xpdf:2.03 cpe:/a:foolabs:xpdf:2.02 cpe:/a:foolabs:xpdf:2.01 cpe:/a:foolabs:xpdf:2.00	10
Application	Poppler Poppler cpe:/a:poppler:poppler:0.9.3 cpe:/a:poppler:poppler:0.9.2 cpe:/a:poppler:poppler:0.9.1 cpe:/a:poppler:poppler:0.9.0 cpe:/a:poppler:poppler:0.8.7 cpe:/a:poppler:poppler:0.8.6 cpe:/a:poppler:poppler:0.8.5 cpe:/a:poppler:poppler:0.8.4 cpe:/a:poppler:poppler:0.8.3 cpe:/a:poppler:poppler:0.8.2 cpe:/a:poppler:poppler:0.8.1 cpe:/a:poppler:poppler:0.8.0 cpe:/a:poppler:poppler:0.7.3 cpe:/a:poppler:poppler:0.7.2 cpe:/a:poppler:poppler:0.7.1 cpe:/a:poppler:poppler:0.7.0 cpe:/a:poppler:poppler:0.6.4 cpe:/a:poppler:poppler:0.6.3 cpe:/a:poppler:poppler:0.6.2 cpe:/a:poppler:poppler:0.6.1 cpe:/a:poppler:poppler:0.6.0 cpe:/a:poppler:poppler:0.5.91 cpe:/a:poppler:poppler:0.5.90 cpe:/a:poppler:poppler:0.5.9 cpe:/a:poppler:poppler:0.5.4 cpe:/a:poppler:poppler:0.5.3 cpe:/a:poppler:poppler:0.5.2 cpe:/a:poppler:poppler:0.5.1 cpe:/a:poppler:poppler:0.5.0 cpe:/a:poppler:poppler:0.4.4 cpe:/a:poppler:poppler:0.4.3 cpe:/a:poppler:poppler:0.4.2 cpe:/a:poppler:poppler:0.4.1 cpe:/a:poppler:poppler:0.4.0 cpe:/a:poppler:poppler:0.3.3 cpe:/a:poppler:poppler:0.3.2 cpe:/a:poppler:poppler:0.3.1 cpe:/a:poppler:poppler:0.3.0 cpe:/a:poppler:poppler:0.2.0 cpe:/a:poppler:poppler:0.12.0 cpe:/a:poppler:poppler:0.11.3 cpe:/a:poppler:poppler:0.11.2 cpe:/a:poppler:poppler:0.11.1 cpe:/a:poppler:poppler:0.11.0 cpe:/a:poppler:poppler:0.10.7 cpe:/a:poppler:poppler:0.10.6 cpe:/a:poppler:poppler:0.10.5 cpe:/a:poppler:poppler:0.10.4 cpe:/a:poppler:poppler:0.10.3 cpe:/a:poppler:poppler:0.10.2 cpe:/a:poppler:poppler:0.10.1 cpe:/a:poppler:poppler:0.10.0 cpe:/a:poppler:poppler:0.1.2 cpe:/a:poppler:poppler:0.1.1 cpe:/a:poppler:poppler:0.1	55

Open Source Vulnerability Database (OSVDB)

id	Description
59184	Poppler XRef.cc ObjectStream::ObjectStream Function PDF Handling Overflow
59183	Xpdf XRef.cc ObjectStream::ObjectStream Function PDF Handling Overflow
59182	Poppler PSOutputDev::doImageL1Sep Function PDF Handling Overflow
59181	Xpdf PSOutputDev::doImageL1Sep Function PDF Handling Overflow
59180	Poppler Stream.cc ImageStream::ImageStream Function PDF Handling Overflow
59179	Xpdf Stream.cc ImageStream::ImageStream Function PDF Handling Overflow
59178	Poppler SplashBitmap::SplashBitmap Function PDF Handling Overflow
59177	Xpdf SplashBitmap::SplashBitmap Function PDF Handling Overflow
59176	Poppler Splash.cc Splash::drawImage Function PDF Handling Arbitrary Code Exec...
59175	Xpdf Splash.cc Splash::drawImage Function PDF Handling Arbitrary Code Execution
54808	Poppler JBIG2 Decoder SplashBitmap Handling Overflow