CVE-2009-3938

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file.

Desbordamiento de búfer en la función ABWOutputDev::endWord en poppler/ABWOutputDev.cc en Poppler (alias libpoppler) 0.10.6, 0.12.0 y posiblemente otras versiones, tal como se usa en la utilidad Abiword pdftoabw, permite a atacantes remotos asistidos por el usuario provocar una denegación de servicio y posiblemente ejecutar código de su elección mediante un fichero PDF manipulado.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-11-13 CVE Reserved
2009-11-13 CVE Published
2024-05-13 EPSS Updated
2024-08-07 CVE Updated
2024-08-07 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (9)

URL	Tag	Source
http://www.securityfocus.com/bid/36976	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/54215	Vdb Entry

URL	Date	SRC
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534680	2024-08-07
http://bugs.freedesktop.org/show_bug.cgi?id=23074	2024-08-07

URL	Date	SRC
http://bugs.freedesktop.org/attachment.cgi?id=30599&action=edit	2017-08-17

URL	Date	SRC
http://secunia.com/advisories/37333	2017-08-17
http://www.debian.org/security/2009/dsa-1941	2017-08-17
http://www.mandriva.com/security/advisories?name=MDVSA-2011:175	2017-08-17
http://www.vupen.com/english/advisories/2009/3227	2017-08-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Poppler Search vendor "Poppler"		Poppler Search vendor "Poppler" for product "Poppler"				0.10.6 Search vendor "Poppler" for product "Poppler" and version "0.10.6"		-		Affected
Poppler Search vendor "Poppler"		Poppler Search vendor "Poppler" for product "Poppler"				0.12.0 Search vendor "Poppler" for product "Poppler" and version "0.12.0"		-		Affected