CVE-2009-1183

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-04-23 · updated 2026-06-16
Weakness: CWE-399

Description

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.

Affected products

cups: through 1.3.9; 1.1, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5 (+65)
Foolabs Xpdf: 0.5a, 0.7a, 0.91a, 0.91b, 0.91c, 0.92a (+8)
Glyphandcog Xpdfreader: through 3.02; 0.2, 0.3, 0.4, 0.5, 0.6, 0.7 (+13)
Poppler: through 0.10.5; 0.1, 0.1.1, 0.1.2, 0.2.0, 0.3.0, 0.3.1 (+41)

References

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
http://poppler.freedesktop.org/releases.html
http://rhn.redhat.com/errata/RHSA-2009-0458.html
http://secunia.com/advisories/34291
http://secunia.com/advisories/34481
http://secunia.com/advisories/34746
http://secunia.com/advisories/34755
http://secunia.com/advisories/34756
http://secunia.com/advisories/34852
http://secunia.com/advisories/34959

Get alerted when CVE-2009-1183 or the next vulnerability affects your stack