CVE

Id
41470  
CVE No.
CVE-2009-4035  
Status
Candidate  
Description
The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.  
Phase
Assigned (20091120)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
455769 41470 CVE-2009-4035 MISC:http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc?id=4b4fc5c017bf147c9069bbce32fc14467bd2a81a  View
455770 41470 CVE-2009-4035 CONFIRM:http://cgit.freedesktop.org/poppler/poppler/diff/fofi/FoFiType1.cc?id=4b4fc5c0  View
455771 41470 CVE-2009-4035 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=541614  View
455772 41470 CVE-2009-4035 REDHAT:RHSA-2009:1680  View
455773 41470 CVE-2009-4035 URL:http://www.redhat.com/support/errata/RHSA-2009-1680.html  View
455774 41470 CVE-2009-4035 REDHAT:RHSA-2009:1681  View
455775 41470 CVE-2009-4035 URL:http://www.redhat.com/support/errata/RHSA-2009-1681.html  View
455776 41470 CVE-2009-4035 REDHAT:RHSA-2009:1682  View
455777 41470 CVE-2009-4035 URL:http://www.redhat.com/support/errata/RHSA-2009-1682.html  View
455778 41470 CVE-2009-4035 SUSE:SUSE-SR:2010:003  View
455779 41470 CVE-2009-4035 URL:http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html  View
455780 41470 CVE-2009-4035 BID:37350  View
455781 41470 CVE-2009-4035 URL:http://www.securityfocus.com/bid/37350  View
455782 41470 CVE-2009-4035 OVAL:oval:org.mitre.oval:def:10996  View
455783 41470 CVE-2009-4035 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10996  View
455784 41470 CVE-2009-4035 SECTRACK:1023356  View
455785 41470 CVE-2009-4035 URL:http://www.securitytracker.com/id?1023356  View
455786 41470 CVE-2009-4035 SECUNIA:37641  View
455787 41470 CVE-2009-4035 URL:http://secunia.com/advisories/37641  View
455788 41470 CVE-2009-4035 SECUNIA:37781  View
455789 41470 CVE-2009-4035 URL:http://secunia.com/advisories/37781  View
455790 41470 CVE-2009-4035 SECUNIA:37787  View
455791 41470 CVE-2009-4035 URL:http://secunia.com/advisories/37787  View
455792 41470 CVE-2009-4035 SECUNIA:37793  View
455793 41470 CVE-2009-4035 URL:http://secunia.com/advisories/37793  View
455794 41470 CVE-2009-4035 VUPEN:ADV-2009-3555  View
455795 41470 CVE-2009-4035 URL:http://www.vupen.com/english/advisories/2009/3555  View
455796 41470 CVE-2009-4035 XF:xpdf-fofitype1parse-bo(54831)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
45471 JVNDB-2009-006478 Piwigo におけるクロスサイトスクリプティングの脆弱性 Piwigo には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2009-4039 41470 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-006478.html  View