CVE-2009-3607: Buffer Overflow
Integer overflow in the createsurfacefromthumbnaildata function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Other sources
Ludwig Nussel reported an integer overflow in poppler's createsurfacefromthumbnaildata() function. cairopixels buffer is allocated as:
cairopixels = (guchar )gmalloc (4 width height);
http://cgit.freedesktop.org/poppler/poppler/tree/glib/poppler-page.cc#n615
where width / height is read from PDF file. Some validation of the values is done in Page::loadThumb(), but it is not sufficient to prevent the overflow:
if (width > INTMAX / 3 / height)
http://cgit.freedesktop.org/poppler/poppler/tree/poppler/Page.cc#n547
This code does not exist in poppler as shipped in EL5, nor it is part of xpdf.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3607?
CVE-2009-3607 is classified as a moderate severity vulnerability due to its potential to cause denial of service and possible arbitrary code execution.
How do I fix CVE-2009-3607?
To fix CVE-2009-3607, upgrade to a version of Poppler that is not affected, such as version 0.12.0 or later.
What types of attacks are possible with CVE-2009-3607?
An attacker can exploit CVE-2009-3607 through a crafted PDF document to potentially execute arbitrary code or cause memory corruption.
Which versions of Poppler are vulnerable to CVE-2009-3607?
Versions of Poppler from 0.1 to 0.11.3 are vulnerable to CVE-2009-3607.
What is the impact of CVE-2009-3607 on systems using Poppler?
CVE-2009-3607 can lead to denial of service and may allow attackers to execute arbitrary code on affected systems.