CVE-2009-3938
Gentoo Linux Security Advisory 201310-03
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Buffer overflow in the ABWOutputDev::endWord function in poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0, and possibly other versions, as used by the Abiword pdftoabw utility, allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted PDF file.
Desbordamiento de búfer en la función ABWOutputDev::endWord en poppler/ABWOutputDev.cc en Poppler (alias libpoppler) 0.10.6, 0.12.0 y posiblemente otras versiones, tal como se usa en la utilidad Abiword pdftoabw, permite a atacantes remotos asistidos por el usuario provocar una denegación de servicio y posiblemente ejecutar código de su elección mediante un fichero PDF manipulado.
Multiple vulnerabilities have been found in Poppler, some of which may allow execution of arbitrary code. Versions less than 0.22.2-r1 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-11-13 CVE Reserved
- 2009-11-13 CVE Published
- 2024-08-07 CVE Updated
- 2024-08-07 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/36976 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/54215 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534680 | 2024-08-07 | |
| http://bugs.freedesktop.org/show_bug.cgi?id=23074 | 2024-08-07 |
| URL | Date | SRC |
|---|---|---|
| http://bugs.freedesktop.org/attachment.cgi?id=30599&action=edit | 2017-08-17 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/37333 | 2017-08-17 | |
| http://www.debian.org/security/2009/dsa-1941 | 2017-08-17 | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:175 | 2017-08-17 | |
| http://www.vupen.com/english/advisories/2009/3227 | 2017-08-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Poppler Search vendor "Poppler" | Poppler Search vendor "Poppler" for product "Poppler" | 0.10.6 Search vendor "Poppler" for product "Poppler" and version "0.10.6" | - |
Affected
| ||||||
| Poppler Search vendor "Poppler" | Poppler Search vendor "Poppler" for product "Poppler" | 0.12.0 Search vendor "Poppler" for product "Poppler" and version "0.12.0" | - |
Affected
| ||||||