CVE-2009-0165

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-04-23 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."

Affected products

Foolabs Xpdf: 0.5a, 0.7a, 0.91a, 0.91b, 0.91c, 0.92a (+9)
Glyphandcog Xpdfreader: through 3.02; 0.2, 0.3, 0.4, 0.5, 0.6, 0.7 (+13)

References

http://bugs.gentoo.org/show_bug.cgi?id=263028
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
http://secunia.com/advisories/34852
http://secunia.com/advisories/34959
http://secunia.com/advisories/34991
http://secunia.com/advisories/35037
http://secunia.com/advisories/35065
http://secunia.com/advisories/35074

Get alerted when CVE-2009-0165 or the next vulnerability affects your stack