CVE-2009-1183: Medium severity xpdf vulnerability
An infinite loop flaw was found in xpdf's JBIG2 MMR decoder. If a carefully crafted PDF file is opened, it could cause xpdf to stop responding.
Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2 decoder in various PDF libraries that found this flaw.
Acknowledgements:
Red Hat would like to thank Will Dormann of the CERT/CC for responsibly reporting this flaw.
Other sources
The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1183?
CVE-2009-1183 is classified as a moderate severity vulnerability.
How do I fix CVE-2009-1183?
To fix CVE-2009-1183, upgrade affected versions of Xpdf to the latest available version.
What component is affected by CVE-2009-1183?
CVE-2009-1183 affects the JBIG2 MMR decoder in Xpdf versions 0.5a, 0.7a, 0.91a, 0.91b, 0.91c, 0.92a, 0.92b, 0.92c, 0.92d, 0.92e, 0.93a, 0.93b, 0.93c, 1.00a and all versions of Glyph & Cog XpdfReader up to 3.02.
What are the potential consequences of CVE-2009-1183?
Exploitation of CVE-2009-1183 may allow an attacker to cause the Xpdf application to become unresponsive.
How can I check if my system is affected by CVE-2009-1183?
You can check if your system is affected by CVE-2009-1183 by verifying if you have any of the listed vulnerable Xpdf versions installed.