NetSight
IP …
critical9.3

CVE-2009-3604

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly alloca…

Impact

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.

Affected products

VendorProductAffected versions
FoolabsXpdf
Versions 3.02pl1, 3.02pl2, 3.02pl3
GlyphandcogXpdfreader
Versions 2.00, 2.01, 2.02, 2.03, 3.00, 3.01
PopplerPoppler
Versions 0.1, 0.1.1, 0.1.2, 0.2.0, 0.3.0, 0.3.1

Weakness classification

CWE-399

References