CVE-2009-3606
Published: 21 October 2009
Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Notes
Author | Note |
---|---|
mdeslaur | poppler fixes this with the gmallocn cleanups in CVE-2009-3605 |
Priority
Status
Package | Release | Status |
---|---|---|
gpdf Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
mantic |
Does not exist
|
|
ipe Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
bionic |
Needs triage
|
|
cosmic |
Ignored
(end of life)
|
|
vivid |
Ignored
(end of life)
|
|
kinetic |
Ignored
(end of life, was needs-triage)
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life)
|
|
focal |
Needs triage
|
|
groovy |
Ignored
(end of life)
|
|
hardy |
Ignored
(end of life)
|
|
hirsute |
Ignored
(end of life)
|
|
impish |
Ignored
(end of life)
|
|
intrepid |
Ignored
(end of life, was needs-triage)
|
|
jammy |
Needs triage
|
|
jaunty |
Ignored
(end of life)
|
|
karmic |
Ignored
(end of life)
|
|
lucid |
Ignored
(end of life)
|
|
maverick |
Ignored
(end of life)
|
|
natty |
Ignored
(end of life)
|
|
oneiric |
Ignored
(end of life)
|
|
precise |
Ignored
(end of life)
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Ignored
(end of life)
|
|
saucy |
Ignored
(end of life)
|
|
trusty |
Does not exist
(trusty was needs-triage)
|
|
upstream |
Needs triage
|
|
utopic |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Needs triage
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Ignored
(end of life)
|
|
mantic |
Needs triage
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
|
kdegraphics Launchpad, Ubuntu, Debian |
kinetic |
Does not exist
|
artful |
Does not exist
|
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Not vulnerable
(linked to poppler)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hardy |
Not vulnerable
(linked to poppler)
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Not vulnerable
(linked to poppler)
|
|
jammy |
Does not exist
|
|
jaunty |
Not vulnerable
(linked to poppler)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
lucid |
Not vulnerable
(linked to poppler)
|
|
lunar |
Does not exist
|
|
maverick |
Not vulnerable
(linked to poppler)
|
|
natty |
Not vulnerable
(linked to poppler)
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
mantic |
Does not exist
|
|
koffice Launchpad, Ubuntu, Debian |
kinetic |
Does not exist
|
artful |
Does not exist
|
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hardy |
Ignored
(end of life)
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Ignored
(end of life, was needed)
|
|
jammy |
Does not exist
|
|
jaunty |
Released
(1:1.6.3-7ubuntu6.1)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
lucid |
Not vulnerable
(code not present)
|
|
lunar |
Does not exist
|
|
maverick |
Not vulnerable
(code not present)
|
|
natty |
Not vulnerable
(code not present)
|
|
oneiric |
Not vulnerable
(code not present)
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
mantic |
Does not exist
|
|
poppler Launchpad, Ubuntu, Debian |
kinetic |
Not vulnerable
|
artful |
Not vulnerable
|
|
bionic |
Not vulnerable
|
|
cosmic |
Not vulnerable
|
|
dapper |
Released
(0.5.1-0ubuntu7.6)
|
|
disco |
Not vulnerable
|
|
eoan |
Not vulnerable
|
|
focal |
Not vulnerable
|
|
groovy |
Not vulnerable
|
|
hardy |
Released
(0.6.4-1ubuntu3.3)
|
|
hirsute |
Not vulnerable
|
|
impish |
Not vulnerable
|
|
intrepid |
Released
(0.8.7-1ubuntu0.4)
|
|
jammy |
Not vulnerable
|
|
jaunty |
Released
(0.10.5-1ubuntu2.4)
|
|
karmic |
Not vulnerable
|
|
lucid |
Not vulnerable
|
|
lunar |
Not vulnerable
|
|
maverick |
Not vulnerable
|
|
natty |
Not vulnerable
|
|
oneiric |
Not vulnerable
|
|
precise |
Not vulnerable
|
|
quantal |
Not vulnerable
|
|
raring |
Not vulnerable
|
|
saucy |
Not vulnerable
|
|
trusty |
Does not exist
(trusty was not-affected)
|
|
upstream |
Needs triage
|
|
utopic |
Not vulnerable
|
|
vivid |
Not vulnerable
|
|
wily |
Not vulnerable
|
|
xenial |
Not vulnerable
|
|
yakkety |
Not vulnerable
|
|
zesty |
Not vulnerable
|
|
mantic |
Not vulnerable
|
|
tetex-bin Launchpad, Ubuntu, Debian |
kinetic |
Does not exist
|
artful |
Does not exist
|
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Not vulnerable
(linked to poppler)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
mantic |
Does not exist
|
|
texlive-bin Launchpad, Ubuntu, Debian |
kinetic |
Not vulnerable
(linked to poppler)
|
artful |
Not vulnerable
(linked to poppler)
|
|
bionic |
Not vulnerable
(linked to poppler)
|
|
cosmic |
Not vulnerable
(linked to poppler)
|
|
dapper |
Does not exist
|
|
disco |
Not vulnerable
(linked to poppler)
|
|
eoan |
Not vulnerable
(linked to poppler)
|
|
focal |
Not vulnerable
(linked to poppler)
|
|
groovy |
Not vulnerable
(linked to poppler)
|
|
hardy |
Not vulnerable
(linked to poppler)
|
|
hirsute |
Not vulnerable
(linked to poppler)
|
|
impish |
Not vulnerable
(linked to poppler)
|
|
intrepid |
Not vulnerable
(linked to poppler)
|
|
jammy |
Not vulnerable
(linked to poppler)
|
|
jaunty |
Not vulnerable
(linked to poppler)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
lucid |
Not vulnerable
(linked to poppler)
|
|
lunar |
Not vulnerable
(linked to poppler)
|
|
maverick |
Not vulnerable
(linked to poppler)
|
|
natty |
Not vulnerable
(linked to poppler)
|
|
oneiric |
Not vulnerable
(linked to poppler)
|
|
precise |
Not vulnerable
(linked to poppler)
|
|
quantal |
Not vulnerable
(linked to poppler)
|
|
raring |
Not vulnerable
(linked to poppler)
|
|
saucy |
Not vulnerable
(linked to poppler)
|
|
trusty |
Does not exist
(trusty was not-affected [linked to poppler])
|
|
upstream |
Needs triage
|
|
utopic |
Not vulnerable
(linked to poppler)
|
|
vivid |
Not vulnerable
(linked to poppler)
|
|
wily |
Not vulnerable
(linked to poppler)
|
|
xenial |
Not vulnerable
(linked to poppler)
|
|
yakkety |
Not vulnerable
(linked to poppler)
|
|
zesty |
Not vulnerable
(linked to poppler)
|
|
mantic |
Not vulnerable
(linked to poppler)
|
|
libextractor Launchpad, Ubuntu, Debian |
trusty |
Not vulnerable
(does not use xpdf anymore)
|
artful |
Ignored
(end of life)
|
|
bionic |
Not vulnerable
(does not use xpdf anymore)
|
|
cosmic |
Ignored
(end of life)
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Ignored
(end of life)
|
|
focal |
Not vulnerable
(does not use xpdf anymore)
|
|
groovy |
Ignored
(end of life)
|
|
hardy |
Ignored
(end of life)
|
|
hirsute |
Ignored
(end of life)
|
|
impish |
Ignored
(end of life)
|
|
intrepid |
Ignored
(end of life, was needs-triage)
|
|
jammy |
Not vulnerable
(does not use xpdf anymore)
|
|
jaunty |
Ignored
(end of life)
|
|
karmic |
Ignored
(end of life)
|
|
kinetic |
Not vulnerable
(does not use xpdf anymore)
|
|
lucid |
Ignored
(end of life)
|
|
lunar |
Not vulnerable
(does not use xpdf anymore)
|
|
maverick |
Ignored
(end of life)
|
|
natty |
Ignored
(end of life)
|
|
oneiric |
Ignored
(end of life)
|
|
precise |
Ignored
(end of life)
|
|
quantal |
Ignored
(end of life)
|
|
raring |
Ignored
(end of life)
|
|
saucy |
Ignored
(end of life)
|
|
upstream |
Needs triage
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Not vulnerable
(does not use xpdf anymore)
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Ignored
(end of life)
|
|
mantic |
Not vulnerable
(does not use xpdf anymore)
|
|
pdfkit.framework Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
mantic |
Does not exist
|
|
pdftohtml Launchpad, Ubuntu, Debian |
artful |
Does not exist
|
bionic |
Does not exist
|
|
cosmic |
Does not exist
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Does not exist
|
|
eoan |
Does not exist
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hardy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
intrepid |
Does not exist
|
|
jammy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
kinetic |
Does not exist
|
|
lucid |
Does not exist
|
|
lunar |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
mantic |
Does not exist
|
|
xpdf Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
(3.02-2)
|
bionic |
Not vulnerable
(3.02-2)
|
|
cosmic |
Not vulnerable
(3.02-2)
|
|
dapper |
Ignored
(end of life)
|
|
disco |
Not vulnerable
(3.02-2)
|
|
eoan |
Not vulnerable
(3.02-2)
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hardy |
Ignored
(end of life)
|
|
hirsute |
Not vulnerable
|
|
impish |
Not vulnerable
|
|
intrepid |
Ignored
(end of life, was needs-triage)
|
|
jammy |
Not vulnerable
|
|
jaunty |
Released
(3.02-1.4ubuntu2.9.04.1)
|
|
karmic |
Released
(3.02-1.4ubuntu2.9.10.1)
|
|
kinetic |
Not vulnerable
|
|
lucid |
Not vulnerable
(3.02-2)
|
|
lunar |
Not vulnerable
|
|
maverick |
Not vulnerable
(3.02-2)
|
|
natty |
Not vulnerable
(3.02-2)
|
|
oneiric |
Not vulnerable
(3.02-2)
|
|
precise |
Not vulnerable
(3.02-2)
|
|
quantal |
Not vulnerable
(3.02-2)
|
|
raring |
Not vulnerable
(3.02-2)
|
|
saucy |
Not vulnerable
(3.02-2)
|
|
trusty |
Does not exist
(trusty was not-affected [3.02-2])
|
|
upstream |
Released
(3.02-2)
|
|
utopic |
Not vulnerable
(3.02-2)
|
|
vivid |
Not vulnerable
(3.02-2)
|
|
wily |
Not vulnerable
(3.02-2)
|
|
xenial |
Not vulnerable
(3.02-2)
|
|
yakkety |
Not vulnerable
(3.02-2)
|
|
zesty |
Not vulnerable
(3.02-2)
|
|
mantic |
Not vulnerable
|