CVE-2009-1187

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-04-23 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev (CairoOutputDev.cc).

Affected products

Poppler: through 0.10.5; 0.1, 0.1.1, 0.1.2, 0.2.0, 0.3.0, 0.3.1 (+41)

References

http://bugs.gentoo.org/show_bug.cgi?id=263028#c16
http://poppler.freedesktop.org/releases.html
http://secunia.com/advisories/34746
http://secunia.com/advisories/35064
http://secunia.com/advisories/35618
http://wiki.rpath.com/Advisories:rPSA-2009-0059
http://www.kb.cert.org/vuls/id/196617
http://www.mandriva.com/security/advisories?name=MDVSA-2010:087
http://www.mandriva.com/security/advisories?name=MDVSA-2011:175
http://www.redhat.com/support/errata/RHSA-2009-0480.html
http://www.securityfocus.com/archive/1/502761/100/0/threaded
http://www.securityfocus.com/bid/34568

Get alerted when CVE-2009-1187 or the next vulnerability affects your stack