CVE-2009-1181: Null Pointer Dereference
Multiple NULL derefernce flaws were found in xpdf's JBIG2 decoder. A carefully crafted PDF file could cause xpdf to crash when opened.
Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.
Acknowledgements:
Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting these flaws.
Other sources
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What types of vulnerabilities are documented in CVE-2009-1181?
CVE-2009-1181 documents multiple NULL dereference flaws in the JBIG2 decoder of xpdf.
What versions of xpdf are affected by CVE-2009-1181?
The affected versions include xpdf 0.5a, 0.7a, 0.91a, 0.91b, 0.91c, 0.92a, 0.92b, 0.92c, 0.92d, 0.92e, 0.93a, 0.93b, 0.93c, and 1.00a.
How can I mitigate the risk associated with CVE-2009-1181?
To mitigate the risk of CVE-2009-1181, users should update their xpdf software to a patched version that resolves this vulnerability.
What happens when CVE-2009-1181 is exploited?
Exploitation of CVE-2009-1181 can lead to a crash of the xpdf application when processing a specially crafted PDF file.
Who identified the vulnerability in CVE-2009-1181?
The vulnerability in CVE-2009-1181 was identified by Will Dormann from CERT/CC, who created a test suite for the JBIG2 decoder.