Skip to content
Fencer Vulns
medium 4.3

CVE-2009-3609 json

Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, k…

published 2009-10-21 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-3590

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.7%
EPSS 4.7% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.

Patch / fix

  • xpdf Debian 14, Debian 13, Debian 12 3.02-2
  • poppler Debian 14, Debian 13, Debian 12 0.12.2-1

debian advisories DEBIAN-CVE-2009-3609

  • cups RHEL 4 1:1.1.22-0.rc1.9.32.el4_8.10
  • cups-libs RHEL 4 1:1.1.22-0.rc1.9.32.el4_8.10
  • tetex RHEL 3 1.0.7-67.19
  • tetex-afm RHEL 3 1.0.7-67.19
  • tetex-xdvi RHEL 3 1.0.7-67.19
  • tetex-dvips RHEL 3 1.0.7-67.19
  • tetex-fonts RHEL 3 1.0.7-67.19
  • tetex-latex RHEL 3 1.0.7-67.19

red hat advisories RHSA-2010:0755RHSA-2010:0401RHSA-2010:0400RHSA-2010:0399RHSA-2009:1513RHSA-2009:1512

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-3609 updated cvss 2.1

xpdf/poppler: ImageStream:: ImageStream integer overflow

  • Red Hat Desktop version 3 xpdf 2.02-17.el3, tetex 1.0.7-67.19, tetex-afm 1.0.7-67.19, tetex-xdvi 1.0.7-67.19, tetex-dvips 1.0.7-67.19, tetex-fonts 1.0.7-67.19, +1 more
    fixed: vendor fix RHSA-2010:0401
  • Red Hat Enterprise Linux (v. 5 server) cups 1.3.7-11.el5_4.3, tetex 3.0-33.8.el5_5.5, cups-lpd 1.3.7-11.el5_4.3, cups-libs 1.3.7-11.el5_4.3, poppler 0.5.4-4.4.el5_4.11, tetex-afm 3.0-33.8.el5_5.5, +5 more
    fixed: vendor fix RHSA-2009:1513
  • Red Hat Enterprise Linux AS version 3 xpdf 2.02-17.el3, tetex 1.0.7-67.19, tetex-afm 1.0.7-67.19, tetex-xdvi 1.0.7-67.19, tetex-dvips 1.0.7-67.19, tetex-fonts 1.0.7-67.19, +1 more
    fixed: vendor fix RHSA-2010:0401
  • Red Hat Enterprise Linux AS version 4 xpdf 3.00-22.el4_8.1, gpdf 2.8.2-7.7.2.el4_8.5, tetex 2.0.2-22.0.1.EL4.16, kdegraphics 3.3.1-15.el4_8.2, tetex-afm 2.0.2-22.0.1.EL4.16, tetex-xdvi 2.0.2-22.0.1.EL4.16, +5 more
    fixed: vendor fix RHSA-2010:0755
  • Red Hat Enterprise Linux Desktop (v. 5 client) cups 1.3.7-11.el5_4.3, tetex 3.0-33.8.el5_5.5, cups-lpd 1.3.7-11.el5_4.3, cups-libs 1.3.7-11.el5_4.3, poppler 0.5.4-4.4.el5_4.11, tetex-afm 3.0-33.8.el5_5.5, +6 more
    fixed: vendor fix RHSA-2009:1513
  • Red Hat Enterprise Linux Desktop version 4 xpdf 3.00-22.el4_8.1, gpdf 2.8.2-7.7.2.el4_8.5, tetex 2.0.2-22.0.1.EL4.16, kdegraphics 3.3.1-15.el4_8.2, tetex-afm 2.0.2-22.0.1.EL4.16, tetex-xdvi 2.0.2-22.0.1.EL4.16, +5 more
    fixed: vendor fix RHSA-2010:0755
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) cups 1.3.7-11.el5_4.3, cups-lpd 1.3.7-11.el5_4.3, cups-libs 1.3.7-11.el5_4.3, poppler 0.5.4-4.4.el5_4.11, kdegraphics 3.5.4-15.el5_4.2, poppler-utils 0.5.4-4.4.el5_4.11
    fixed: vendor fix RHSA-2009:1513
  • Red Hat Enterprise Linux ES version 3 xpdf 2.02-17.el3, tetex 1.0.7-67.19, tetex-afm 1.0.7-67.19, tetex-xdvi 1.0.7-67.19, tetex-dvips 1.0.7-67.19, tetex-fonts 1.0.7-67.19, +1 more
    fixed: vendor fix RHSA-2010:0401
show 4 more
  • Red Hat Enterprise Linux ES version 4 xpdf 3.00-22.el4_8.1, gpdf 2.8.2-7.7.2.el4_8.5, tetex 2.0.2-22.0.1.EL4.16, kdegraphics 3.3.1-15.el4_8.2, tetex-afm 2.0.2-22.0.1.EL4.16, tetex-xdvi 2.0.2-22.0.1.EL4.16, +5 more
    fixed: vendor fix RHSA-2010:0755
  • Red Hat Enterprise Linux Optional Productivity Applications (v. 5 server) kdegraphics 3.5.4-15.el5_4.2
    fixed: vendor fix RHSA-2009:1502
  • Red Hat Enterprise Linux WS version 3 xpdf 2.02-17.el3, tetex 1.0.7-67.19, tetex-afm 1.0.7-67.19, tetex-xdvi 1.0.7-67.19, tetex-dvips 1.0.7-67.19, tetex-fonts 1.0.7-67.19, +1 more
    fixed: vendor fix RHSA-2010:0401
  • Red Hat Enterprise Linux WS version 4 xpdf 3.00-22.el4_8.1, gpdf 2.8.2-7.7.2.el4_8.5, tetex 2.0.2-22.0.1.EL4.16, kdegraphics 3.3.1-15.el4_8.2, tetex-afm 2.0.2-22.0.1.EL4.16, tetex-xdvi 2.0.2-22.0.1.EL4.16, +5 more
    fixed: vendor fix RHSA-2010:0755

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.67% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=526893 referenced PoC, tagged "exploit" by a source, unverified
  • securityfocus.com http://www.securityfocus.com/bid/36703 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.