vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2009-3609

N/A
Published: October 21, 2009 at 05:00 PM UTC
Updated: June 16, 2026 at 11:12 PM UTC
4 products affected across 3 vendorsXpdfreaderPopplerXpdf· also runs on 2 platforms

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 5%

Description

Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Xpdf· Foolabs
95%
3.02pl13.02pl23.02pl3
glyphandcog-pdftops (environment) · gnome-gpdf (environment) · kde-kpdf (environment)
Xpdfreader· Glyphandcog
95%
3.003.013.02
glyphandcog-pdftops (environment) · gnome-gpdf (environment) · kde-kpdf (environment)
Poppler· Poppler
95%
v ≤ 0.12.00.10.1.10.1.20.10.00.10.10.10.20.10.30.10.40.10.50.10.60.10.70.11.00.11.10.11.20.11.30.2.00.3.00.3.10.3.20.3.30.4.00.4.10.4.20.4.30.4.40.5.00.5.10.5.20.5.30.5.40.5.90.6.00.6.10.6.20.6.30.6.40.7.00.7.10.7.20.7.30.8.00.8.10.8.20.8.30.8.40.8.60.8.70.9.00.9.10.9.20.9.3
glyphandcog-pdftops (environment) · gnome-gpdf (environment) · kde-kpdf (environment)
Pdftops· Glyphandcogdevice
80%
All versions

Runs on — not affected

The affected product only carries this flaw when running on these platforms. The platforms themselves are not vulnerable.

References (51)

x_refsource_CONFIRMExploit
Source: [email protected]
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl4.patch
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.html
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.html
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
x_refsource_CONFIRMPatchVendor Advisory
Source: [email protected]
http://poppler.freedesktop.org/
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/37023
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/37028

CVSS

4.3MEDIUM[email protected]
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-189

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card