National Cyber Awareness System

Vulnerability Summary for CVE-2009-4035

Overview

The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=541614

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=541614

External Source: XF

Name: xpdf-fofitype1parse-bo(54831)

Hyperlink:http://xforce.iss.net/xforce/xfdb/54831

External Source: VUPEN

Name: ADV-2009-3555

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/3555

External Source: SECTRACK

Name: 1023356

Hyperlink:http://www.securitytracker.com/id?1023356

External Source: BID

Name: 37350

Hyperlink:http://www.securityfocus.com/bid/37350

External Source: REDHAT

Name: RHSA-2009:1682

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-1682.html

External Source: REDHAT

Name: RHSA-2009:1681

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-1681.html

External Source: REDHAT

Name: RHSA-2009:1680

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-1680.html

External Source: SECUNIA

Name: 37793

Type: Advisory

Hyperlink:http://secunia.com/advisories/37793

External Source: SECUNIA

Name: 37787

Type: Advisory

Hyperlink:http://secunia.com/advisories/37787

External Source: SECUNIA

Name: 37781

Type: Advisory

Hyperlink:http://secunia.com/advisories/37781

External Source: SECUNIA

Name: 37641

Type: Advisory

Hyperlink:http://secunia.com/advisories/37641

External Source: OVAL

Name: oval:org.mitre.oval:def:10996

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10996

External Source: SUSE

Name: SUSE-SR:2010:003

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html

External Source: MISC

Name: http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc?id=4b4fc5c017bf147c9069bbce32fc14467bd2a81a

Hyperlink:http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc?id=4b4fc5c017bf147c9069bbce32fc14467bd2a81a

External Source: CONFIRM

Name: http://cgit.freedesktop.org/poppler/poppler/diff/fofi/FoFiType1.cc?id=4b4fc5c0

Hyperlink:http://cgit.freedesktop.org/poppler/poppler/diff/fofi/FoFiType1.cc?id=4b4fc5c0

References to Check Content

Identifier:oval:org.mitre.oval:def:10996

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10996