CVE-2009-1144

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-04-09 · updated 2026-06-16
Weakness: CWE-94

Description

Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.

Affected products

Foolabs Xpdf: 0.5a, 0.7a, 0.91a, 0.91b, 0.91c, 0.92a (+8)
Glyphandcog Xpdfreader: through 3.02; 0.2, 0.3, 0.4, 0.5, 0.6, 0.7 (+11)

References

http://bugs.gentoo.org/show_bug.cgi?id=200023
http://bugs.gentoo.org/show_bug.cgi?id=242930
http://osvdb.org/53529
http://secunia.com/advisories/34610
http://security.gentoo.org/glsa/glsa-200904-07.xml
http://www.securityfocus.com/bid/34401
http://bugs.gentoo.org/show_bug.cgi?id=200023
http://bugs.gentoo.org/show_bug.cgi?id=242930
http://osvdb.org/53529
http://secunia.com/advisories/34610
http://security.gentoo.org/glsa/glsa-200904-07.xml
http://www.securityfocus.com/bid/34401

Get alerted when CVE-2009-1144 or the next vulnerability affects your stack