CVE-2009-3608

Name of the Vulnerable Software and Affected Versions Xpdf versions prior to 3.02pl4 Poppler versions prior to 0.12.1 libkscan-dev (affected versions not specified) kdegraphics-dev (affected versions not specified) xpdf-common (affected versions not specified) kviewshell (affected versions not specified) kdegraphics-dbg (affected versions not specified) kdegraphics-doc-html (affected versions not specified) kdvi (affected versions not specified) xpdf-reader (affected versions not specified) libkscan1 (affected versions not specified) xpdf-utils (affected versions not specified) kdegraphics (affected versions not specified) kdegraphics-kfile-plugins (affected versions not specified)

Description The issue involves multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libkscan-dev, kdegraphics-dev, xpdf-common, kviewshell, kdegraphics-dbg, kdegraphics-doc-html, kdvi, xpdf-reader, libkscan1, xpdf-utils, kdegraphics, and kdegraphics-kfile-plugins. These vulnerabilities can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.

Recommendations For Xpdf versions prior to 3.02pl4, update to version 3.02pl4 or later. For Poppler versions prior to 0.12.1, update to version 0.12.1 or later. For libkscan-dev, consider disabling the vulnerable functions until a patch is available. For kdegraphics-dev, consider restricting access to the vulnerable modules to minimize the risk of exploitation. For xpdf-common, kviewshell, kdegraphics-dbg, kdegraphics-doc-html, kdvi, xpdf-reader, libkscan1, xpdf-utils, kdegraphics, and kdegraphics-kfile-plugins, at the moment, there is no information about a newer version that contains a fix for this vulnerability.