Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Coregraphics | — | Apply OS X security update 2009-002Upgrade macOS to the latest version | Dec 16, 2011 | Apr 23, 2009 |
| Centos_linux | — | Upgrade tetex-fontsUpgrade kdegraphics-develUpgrade cups-libsUpgrade tetex-dvipsUpgrade tetex-afmUpgrade kdegraphicsUpgrade tetexUpgrade tetex-docUpgrade cups-develUpgrade cups-lpdUpgrade cupsUpgrade gpdfUpgrade tetex-xdviUpgrade xpdfUpgrade poppler-develUpgrade tetex-latexUpgrade poppler-utilsUpgrade poppler | Dec 1, 2016 | Apr 23, 2009 |
| Debian | — | Upgrade xpdfUpgrade poppler | Jul 30, 2024 | Apr 23, 2009 |
| Freebsd | — | Upgrade xpdfUpgrade cups-base | Dec 10, 2025 | May 7, 2009 |
| Gentoo Linux | — | Upgrade app-text/poppler.Upgrade net-print/cups. | Oct 30, 2017 | Apr 23, 2009 |
| Oracle_linux | — | Upgrade cups-libsUpgrade tetex-fontsUpgrade cupsUpgrade popplerUpgrade poppler-utilsUpgrade tetex-latexUpgrade tetex-xdviUpgrade tetexUpgrade tetex-dvipsUpgrade cups-lpdUpgrade cups-develUpgrade poppler-develUpgrade tetex-docUpgrade tetex-afm | Oct 16, 2024 | Apr 23, 2009 |
| Suse | — | Upgrade xpdf-toolsUpgrade libpoppler4 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpoppler3Upgrade kwordUpgrade libpoppler-glib2Upgrade libpoppler-glib3Upgrade libpoppler2Upgrade libpoppler1-glibUpgrade libpoppler1 | Nov 8, 2024 | Apr 23, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub