CVE-2009-3608: Buffer Overflow
Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Other sources
oCERT reported an integer overflow flaw during the C++ object allocation leading to a heap overflow discovered by Chris Rohlf, affecting xpdf's / poppler's ObjectStream::ObjectStream (XRef.cc).
objs = new Object[nObjects];
As new[] as implemented in gcc / libstdc++ does not perform integer overflow check [1], sufficiently large nObjects value (read from the input PDF file) can cause integer overflow / wrap when multiplied by sizeof(Object) resulting in insufficient memory allocation.
Affected code was introduced in Xpdf 3.00, packages including / based on this version are affected by this flaw. In Red Hat Enterprise Linux, that means: - xpdf - el4 - gpdf - el4 - poppler - el5 - kdegraphics - el4, el5 - cups - el5 - tetex - el5
Patch attempting to address this was previously added to poppler, but it incorrectly used sizeof(int) instead of sizeof(Object) [2] and hence was insufficient.
[1] http://gcc.gnu.org/bugzilla/showbug.cgi?id=19351 [2] http://cgit.freedesktop.org/poppler/poppler/commit/?id=c36d8afc http://cgit.freedesktop.org/poppler/poppler/commit/?id=f41fa9ee
Acknowledgements:
Red Hat would like to thank Chris Rohlf for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-3608?
CVE-2009-3608 is classified as a critical vulnerability due to its potential to allow remote code execution via crafted PDF documents.
How do I fix CVE-2009-3608?
To fix CVE-2009-3608, update Xpdf to version 3.02pl4 or later, and ensure affected software packages like Gpdf, kdegraphics, Poppler, CUPS, and teTeX are also updated to their respective fixed versions.
Which software is affected by CVE-2009-3608?
CVE-2009-3608 affects Xpdf versions prior to 3.02pl4, Poppler before 0.12.1, and various other applications like Gpdf, kdegraphics KPDF, and CUPS.
Can CVE-2009-3608 be exploited remotely?
Yes, CVE-2009-3608 can be exploited remotely through specially crafted PDF files designed to trigger the vulnerability.
What are the consequences of exploiting CVE-2009-3608?
Exploiting CVE-2009-3608 can lead to arbitrary code execution on the affected system, which may compromise its integrity and security.