CVE-2009-3608

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-10-21 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.

Affected products

Foolabs Xpdf: 3.02pl1, 3.02pl2, 3.02pl3
Glyphandcog Xpdfreader: 3.00, 3.01, 3.02
Poppler: through 0.12.0; 0.1, 0.1.1, 0.1.2, 0.2.0, 0.3.0, 0.3.1 (+45)

References

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
http://poppler.freedesktop.org/
http://secunia.com/advisories/37028
http://secunia.com/advisories/37034
http://secunia.com/advisories/37037
http://secunia.com/advisories/37043
http://secunia.com/advisories/37051
http://secunia.com/advisories/37053

Get alerted when CVE-2009-3608 or the next vulnerability affects your stack