CVE-2009-0165
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other...
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
- Record
CVE-2009-0165- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
- Record
CVE-2009-0165- Updated
- 2026-11-02
EUVDEUVD-2009-0174 No score
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
- Record
EUVD-2009-0174- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qx4p-wc3g-wr66 No score
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other...
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
- Record
GHSA-qx4p-wc3g-wr66- Updated
- 2026-11-02
OSV No score
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
- Record
CVE-2009-0165- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-0165 No score
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."
- Record
DEBIAN-CVE-2009-0165- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xpdfDebian:12 |
before 3.02-1.4+lenny1 | 3.02-1.4+lenny1 |
xpdfDebian:13 |
before 3.02-1.4+lenny1 | 3.02-1.4+lenny1 |
xpdfDebian:14 |
before 3.02-1.4+lenny1 | 3.02-1.4+lenny1 |
xpdfDebian:4.0 |
before 3.01-9.1+etch6, plus listed versions 3.01-93.01-9.1+etch23.01-9.1+etch43.01-9.1+etch53.01-9etch1 |
3.01-9.1+etch6 |
xpdfDebian:5.0 |
before 3.02-1.4+lenny1, plus listed versions 3.02-1.4 |
3.02-1.4+lenny1 |
kdegraphicsDebian:4.0 |
before 4:3.5.5-3etch3, plus listed versions 4:3.5.5-34:3.5.5-3etch14:3.5.5-3etch2 |
4:3.5.5-3etch3 |
kdegraphicsDebian:5.0 |
before 4:3.5.9-3+lenny1, plus listed versions 4:3.5.9-3 |
4:3.5.9-3+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0165 is a high vulnerability (CVSS 10.0) in Foolabs Xpdf, published April 23, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.59%, the 89th percentile. Fixed in xpdf 3.02-1.4+lenny1.
References
debian.org/security/2009/dsa-1793
support.apple.com/kb/HT3639
secunia.com/advisories/35037
vupen.com/english/advisories/2009/1621
Show 21 moreShow less
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477
bugs.gentoo.org/show_bug.cgi?id=263028
lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
securityfocus.com/bid/34568
lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html
mandriva.com/security/advisories?name=MDVSA-2009:101
us-cert.gov/cas/techalerts/TA09-133A.html
exchange.xforce.ibmcloud.com/vulnerabilities/50377
nvd.nist.gov/vuln/detail/CVE-2009-0165
github.com/advisories/GHSA-qx4p-wc3g-wr66
security-tracker.debian.org/tracker/CVE-2009-0165