CVE Feed

    Dashboard / CVE / CVE-2009-4035

    CVE-2009-4035

    The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.

    Published:Dec 16, 2009
    Last Modified:Apr 23, 2026
    EPS:Dec 21, 2009
    EPSS Score:0.0245
    CVSS Score:9.3

    Affected Products

    Vendor
    Gnome
    Product
    Gpdf
    Vendor
    Kde
    Product
    Kdegraphics
    Vendor
    Kde
    Product
    Kpdf
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Xpdf
    Product
    Xpdf

    Exploits

    No exploit reference

    Related CVEs

    CVE-2009-3608 (CVSS 9.3) — Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler …
    CVE-2009-3609 (CVSS 4.3) — Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler befo…
    CVE-2009-3604 (CVSS 9.3) — The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GP…
    CVE-2006-1244 (CVSS 7.6) — Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pd…
    CVE-2004-0889 (CVSS 10) — Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attac…
    CVE-2004-0888 (CVSS 10) — Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and …
    CVE-2005-0206 (CVSS 7.5) — The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit ar…

    References

    http://cgit.freedesktop.org/poppler/poppler/diff/fofi/FoFiType1.cc?id=4b4fc5c0
    http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc?id=4b4fc5c017bf147c9069bbce32fc14467bd2a81a
    http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html
    http://secunia.com/advisories/37641
    http://secunia.com/advisories/37781
    http://secunia.com/advisories/37787
    http://secunia.com/advisories/37793
    http://www.redhat.com/support/errata/RHSA-2009-1680.html
    http://www.redhat.com/support/errata/RHSA-2009-1681.html
    http://www.redhat.com/support/errata/RHSA-2009-1682.html
    http://www.securityfocus.com/bid/37350
    http://www.securitytracker.com/id?1023356
    http://www.vupen.com/english/advisories/2009/3555
    https://bugzilla.redhat.com/show_bug.cgi?id=541614
    https://exchange.xforce.ibmcloud.com/vulnerabilities/54831
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10996
    http://cgit.freedesktop.org/poppler/poppler/diff/fofi/FoFiType1.cc?id=4b4fc5c0
    http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc?id=4b4fc5c017bf147c9069bbce32fc14467bd2a81a
    http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html
    http://secunia.com/advisories/37641
    http://secunia.com/advisories/37781
    http://secunia.com/advisories/37787
    http://secunia.com/advisories/37793
    http://www.redhat.com/support/errata/RHSA-2009-1680.html
    http://www.redhat.com/support/errata/RHSA-2009-1681.html
    http://www.redhat.com/support/errata/RHSA-2009-1682.html
    http://www.securityfocus.com/bid/37350
    http://www.securitytracker.com/id?1023356
    http://www.vupen.com/english/advisories/2009/3555
    https://bugzilla.redhat.com/show_bug.cgi?id=541614
    https://exchange.xforce.ibmcloud.com/vulnerabilities/54831
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10996

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High