CVE-2009-0791

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-09 · updated 2026-06-16
Weakness: CWE-189

Description

Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.

Affected products

cups: 1.1.17, 1.1.22, 1.3.7

References

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
http://secunia.com/advisories/35340
http://secunia.com/advisories/35685
http://secunia.com/advisories/37023
http://secunia.com/advisories/37028
http://secunia.com/advisories/37037
http://secunia.com/advisories/37043
http://secunia.com/advisories/37077
http://secunia.com/advisories/37079
http://securitytracker.com/id?1022326
http://www.mandriva.com/security/advisories?name=MDVSA-2009:334
http://www.redhat.com/support/errata/RHSA-2009-1083.html

Get alerted when CVE-2009-0791 or the next vulnerability affects your stack