CVE Feed

Dashboard / CVE / CVE-2009-0147

CVE-2009-0147

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.

Published:Apr 16, 2009

Last Modified:Apr 23, 2026

EPS:Apr 23, 2009

EPSS Score:0.02384

CVSS Score:4.3

Affected Products

Vendor

Product

Action

Vendor

Apple

Product

Cups

Apple

Cups

Vendor

Foolabs

Product

Xpdf

Foolabs

Xpdf

Vendor

Glyphandcog

Product

Xpdfreader

Glyphandcog

Xpdfreader

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Exploits

No exploit reference

Common Weakness Enumeration

CWE-190 Integer Overflow or Wraparound

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-92 Forced Integer Overflow

Related CVEs

CVE-2022-26691 (CVSS 6.7) — A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Ca…

CVE-2018-4300 (CVSS 5.9) — The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scrip…

CVE-2017-18190 (CVSS 7.5) — A localhost.localdomain whitelist entry in valid_host() in scheduler/client.c in CUPS before 2.2.2 allows remo…

CVE-2017-18248 (CVSS 5.3) — The add_job function in scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is enabled, can be crashed by…

CVE-2014-9679 (CVSS 6.8) — Integer underflow in the cupsRasterReadPixels function in filter/raster.c in CUPS before 2.0.2 allows remote a…

CVE-2014-5031 (CVSS 5) — The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows r…

CVE-2014-5029 (CVSS 1.5) — The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attac…

CVE-2014-5030 (CVSS 1.9) — CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.c…

CVE-2014-3537 (CVSS 1.2) — The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlin…

CVE-2014-2856 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.…

References

http://bugs.gentoo.org/show_bug.cgi?id=263028

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html

http://rhn.redhat.com/errata/RHSA-2009-0458.html

http://secunia.com/advisories/34291

http://secunia.com/advisories/34481

http://secunia.com/advisories/34755

http://secunia.com/advisories/34756

http://secunia.com/advisories/34852

http://secunia.com/advisories/34959

http://secunia.com/advisories/34963

http://secunia.com/advisories/34991

http://secunia.com/advisories/35037

http://secunia.com/advisories/35064

http://secunia.com/advisories/35065

http://secunia.com/advisories/35074

http://secunia.com/advisories/35618

http://secunia.com/advisories/35685

http://security.gentoo.org/glsa/glsa-200904-20.xml

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477

http://support.apple.com/kb/HT3549

http://support.apple.com/kb/HT3639

http://wiki.rpath.com/Advisories:rPSA-2009-0059

http://wiki.rpath.com/Advisories:rPSA-2009-0061

http://www.debian.org/security/2009/dsa-1790

http://www.debian.org/security/2009/dsa-1793

http://www.mandriva.com/security/advisories?name=MDVSA-2009:101

http://www.mandriva.com/security/advisories?name=MDVSA-2010:087

http://www.redhat.com/support/errata/RHSA-2009-0429.html

http://www.redhat.com/support/errata/RHSA-2009-0430.html

http://www.redhat.com/support/errata/RHSA-2009-0431.html

http://www.redhat.com/support/errata/RHSA-2009-0480.html

http://www.securityfocus.com/archive/1/502750/100/0/threaded

http://www.securityfocus.com/archive/1/502761/100/0/threaded

http://www.securityfocus.com/bid/34568

http://www.securitytracker.com/id?1022073

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

http://www.vupen.com/english/advisories/2009/1065

http://www.vupen.com/english/advisories/2009/1066

http://www.vupen.com/english/advisories/2009/1077

http://www.vupen.com/english/advisories/2009/1297

http://www.vupen.com/english/advisories/2009/1621

http://www.vupen.com/english/advisories/2010/1040

https://bugzilla.redhat.com/show_bug.cgi?id=490614

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9941

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00567.html

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01277.html

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01291.html

http://bugs.gentoo.org/show_bug.cgi?id=263028

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html

http://rhn.redhat.com/errata/RHSA-2009-0458.html

http://secunia.com/advisories/34291

http://secunia.com/advisories/34481

http://secunia.com/advisories/34755

http://secunia.com/advisories/34756

http://secunia.com/advisories/34852

http://secunia.com/advisories/34959

http://secunia.com/advisories/34963

http://secunia.com/advisories/34991

http://secunia.com/advisories/35037

http://secunia.com/advisories/35064

http://secunia.com/advisories/35065

http://secunia.com/advisories/35074

http://secunia.com/advisories/35618

http://secunia.com/advisories/35685

http://security.gentoo.org/glsa/glsa-200904-20.xml

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477

http://support.apple.com/kb/HT3549

http://support.apple.com/kb/HT3639

http://wiki.rpath.com/Advisories:rPSA-2009-0059

http://wiki.rpath.com/Advisories:rPSA-2009-0061

http://www.debian.org/security/2009/dsa-1790

http://www.debian.org/security/2009/dsa-1793

http://www.mandriva.com/security/advisories?name=MDVSA-2009:101

http://www.mandriva.com/security/advisories?name=MDVSA-2010:087

http://www.redhat.com/support/errata/RHSA-2009-0429.html

http://www.redhat.com/support/errata/RHSA-2009-0430.html

http://www.redhat.com/support/errata/RHSA-2009-0431.html

http://www.redhat.com/support/errata/RHSA-2009-0480.html

http://www.securityfocus.com/archive/1/502750/100/0/threaded

http://www.securityfocus.com/archive/1/502761/100/0/threaded

http://www.securityfocus.com/bid/34568

http://www.securitytracker.com/id?1022073

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

http://www.vupen.com/english/advisories/2009/1065

http://www.vupen.com/english/advisories/2009/1066

http://www.vupen.com/english/advisories/2009/1077

http://www.vupen.com/english/advisories/2009/1297

http://www.vupen.com/english/advisories/2009/1621

http://www.vupen.com/english/advisories/2010/1040

https://bugzilla.redhat.com/show_bug.cgi?id=490614

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9941

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00567.html

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01277.html

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01291.html

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High