CVE-2009-1144
Gentoo Linux Security Advisory 200904-7
Severity Score
7.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.
Vulnerabilidad de ruta de búsqueda no confiable en el paquete Gentoo de Xpdf anteriores a v3.02-r2, permite a usuarios locales obtener privilegios a través de un troyano (fichero xpdfrc) en el directorio de trabajo actual, relativo a la macro SYSTEM_XPDFRC no fijada en el proceso de construcción Gentoo, que usa la biblioteca poppler.
A vulnerability in Xpdf might allow local attackers to execute arbitrary code. Erik Wallin reported that Gentoo's Xpdf attempts to read the xpdfrc file from the current working directory if it cannot find a .xpdfrc file in the user's home directory. This is caused by a missing definition of the SYSTEM_XPDFRC macro when compiling a repackaged version of Xpdf. Versions less than 3.02-r2 are affected.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2009-03-25 CVE Reserved
- 2009-04-07 CVE Published
- 2024-08-07 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/53529 | Vdb Entry | |
| http://www.securityfocus.com/bid/34401 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://bugs.gentoo.org/show_bug.cgi?id=200023 | 2019-03-06 | |
| http://bugs.gentoo.org/show_bug.cgi?id=242930 | 2019-03-06 | |
| http://secunia.com/advisories/34610 | 2019-03-06 | |
| http://security.gentoo.org/glsa/glsa-200904-07.xml | 2019-03-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.5a Search vendor "Foolabs" for product "Xpdf" and version "0.5a" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.7a Search vendor "Foolabs" for product "Xpdf" and version "0.7a" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.91a Search vendor "Foolabs" for product "Xpdf" and version "0.91a" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.91b Search vendor "Foolabs" for product "Xpdf" and version "0.91b" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.91c Search vendor "Foolabs" for product "Xpdf" and version "0.91c" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.92a Search vendor "Foolabs" for product "Xpdf" and version "0.92a" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.92b Search vendor "Foolabs" for product "Xpdf" and version "0.92b" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.92c Search vendor "Foolabs" for product "Xpdf" and version "0.92c" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.92d Search vendor "Foolabs" for product "Xpdf" and version "0.92d" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.92e Search vendor "Foolabs" for product "Xpdf" and version "0.92e" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.93a Search vendor "Foolabs" for product "Xpdf" and version "0.93a" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.93b Search vendor "Foolabs" for product "Xpdf" and version "0.93b" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 0.93c Search vendor "Foolabs" for product "Xpdf" and version "0.93c" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Foolabs Search vendor "Foolabs" | Xpdf Search vendor "Foolabs" for product "Xpdf" | 1.00a Search vendor "Foolabs" for product "Xpdf" and version "1.00a" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | <= 3.02 Search vendor "Glyphandcog" for product "Xpdfreader" and version " <= 3.02" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.2 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.2" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.3 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.3" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.4 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.4" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.5 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.5" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.6 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.6" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.7 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.7" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.80 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.80" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.90 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.90" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.91 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.91" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 0.93 Search vendor "Glyphandcog" for product "Xpdfreader" and version "0.93" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 1.00 Search vendor "Glyphandcog" for product "Xpdfreader" and version "1.00" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 1.01 Search vendor "Glyphandcog" for product "Xpdfreader" and version "1.01" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 2.00 Search vendor "Glyphandcog" for product "Xpdfreader" and version "2.00" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 2.01 Search vendor "Glyphandcog" for product "Xpdfreader" and version "2.01" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 2.02 Search vendor "Glyphandcog" for product "Xpdfreader" and version "2.02" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 2.03 Search vendor "Glyphandcog" for product "Xpdfreader" and version "2.03" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|
| Glyphandcog Search vendor "Glyphandcog" | Xpdfreader Search vendor "Glyphandcog" for product "Xpdfreader" | 3.00 Search vendor "Glyphandcog" for product "Xpdfreader" and version "3.00" | - |
Affected
| in | Gentoo Search vendor "Gentoo" | Gentoo Linux Search vendor "Gentoo" for product "Gentoo Linux" | * | - |
Safe
|