Rapid7 Vulnerability & Exploit Database

ELSA-2009-1082 Important: Enterprise Linux cups security update

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

ELSA-2009-1082 Important: Enterprise Linux cups security update

Severity

CVSS

(AV:N/AC:M/Au:N/C:P/I:P/A:P)

Published

06/09/2009

Created

07/25/2018

Added

12/20/2011

Modified

07/04/2017

Description

Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.

Solution(s)

oracle-linux-upgrade-cups
oracle-linux-upgrade-cups-devel
oracle-linux-upgrade-cups-libs
oracle-linux-upgrade-cups-lpd

References

https://attackerkb.com/topics/cve-2009-0791
APPLE-SA-2009-09-10-2
35169
35195
CVE - 2009-0791
CVE - 2009-0949
DSA-1811
OVAL10534
OVAL9631
RHSA-2009:1082
RHSA-2009:1083
RHSA-2009:1500
RHSA-2009:1501
RHSA-2009:1502
RHSA-2009:1503
RHSA-2009:1512
http://oss.oracle.com/pipermail/el-errata/2009-June/001023.html
50926
50941

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;