Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Coregraphics | — | Apply OS X security update 2009-002Upgrade macOS to the latest version | Dec 16, 2011 | Apr 23, 2009 |
| Centos_linux | — | Upgrade poppler-utilsUpgrade tetex-xdviUpgrade tetex-afmUpgrade tetexUpgrade gpdfUpgrade poppler-develUpgrade cups-develUpgrade xpdfUpgrade kdegraphics-develUpgrade tetex-dvipsUpgrade cups-lpdUpgrade popplerUpgrade tetex-docUpgrade tetex-fontsUpgrade cupsUpgrade cups-libsUpgrade tetex-latexUpgrade kdegraphics | Dec 1, 2016 | Apr 23, 2009 |
| Debian | — | Upgrade popplerUpgrade xpdf | Jul 30, 2024 | Apr 23, 2009 |
| Freebsd | — | Upgrade xpdfUpgrade cups-base | Dec 10, 2025 | May 7, 2009 |
| Gentoo Linux | — | Upgrade app-text/poppler.Upgrade net-print/cups. | Oct 30, 2017 | Apr 23, 2009 |
| Oracle_linux | — | Upgrade cupsUpgrade tetex-docUpgrade poppler-develUpgrade tetex-fontsUpgrade tetex-xdviUpgrade cups-libsUpgrade tetex-latexUpgrade tetex-afmUpgrade cups-develUpgrade cups-lpdUpgrade popplerUpgrade poppler-utilsUpgrade tetexUpgrade tetex-dvips | Oct 16, 2024 | Apr 23, 2009 |
| Suse | — | Upgrade libpoppler4 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade kwordUpgrade libpoppler3Upgrade libpoppler-glib2Upgrade libpoppler2Upgrade libpoppler-glib3Upgrade libpoppler1-glibUpgrade libpoppler1 | Nov 8, 2024 | Apr 23, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub