Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Coregraphics | — | Upgrade macOS to the latest versionApply OS X security update 2009-002 | Dec 16, 2011 | Apr 23, 2009 |
| Centos_linux | — | Upgrade tetex-xdviUpgrade tetex-dvipsUpgrade poppler-develUpgrade kdegraphics-develUpgrade cups-develUpgrade tetex-afmUpgrade gpdfUpgrade xpdfUpgrade cups-lpdUpgrade tetexUpgrade poppler-utilsUpgrade popplerUpgrade cupsUpgrade tetex-fontsUpgrade kdegraphicsUpgrade tetex-docUpgrade cups-libsUpgrade tetex-latex | Dec 1, 2016 | Apr 23, 2009 |
| Debian | — | Upgrade xpdfUpgrade poppler | Jul 30, 2024 | Apr 23, 2009 |
| Freebsd | — | Upgrade xpdfUpgrade cups-base | Dec 10, 2025 | May 7, 2009 |
| Gentoo Linux | — | Upgrade net-print/cups.Upgrade app-text/poppler. | Oct 30, 2017 | Apr 23, 2009 |
| Oracle_linux | — | Upgrade tetexUpgrade cups-lpdUpgrade tetex-dvipsUpgrade tetex-latexUpgrade tetex-afmUpgrade cups-develUpgrade poppler-utilsUpgrade popplerUpgrade cups-libsUpgrade poppler-develUpgrade tetex-docUpgrade tetex-fontsUpgrade cupsUpgrade tetex-xdvi | Oct 16, 2024 | Apr 23, 2009 |
| Suse | — | Upgrade libpoppler4 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libpoppler-glib2Upgrade libpoppler3Upgrade libpoppler2Upgrade kwordUpgrade libpoppler1-glibUpgrade libpoppler1Upgrade libpoppler-glib3 | Nov 8, 2024 | Apr 23, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub