CVE-2009-0176
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research...
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
Exploit likelihood
What each source reports
NVD Score used
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
- Record
CVE-2009-0176- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
- Record
CVE-2009-0176- Updated
- 2026-11-02
EUVDEUVD-2009-0185 No score
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
- Record
EUVD-2009-0185- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-42j7-6x8r-f3jv No score
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research...
Multiple heap-based buffer overflows in the PDF distiller in the Attachment Service in Research in Motion (RIM) BlackBerry Enterprise Server (BES) 4.1.3 through 4.1.6, BlackBerry Professional Software 4.1.4, and BlackBerry Unite! before 1.0.3 bundle 28 allow user-assisted remote attackers to execute arbitrary code via (1) a crafted stream in a .pdf file, related to "symWidths"; or (2) a crafted data stream in a .pdf file, related to "bitmaps."
- Record
GHSA-42j7-6x8r-f3jv- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0176 is a high vulnerability (CVSS 9.3) in Research In Motion Limited Blackberry Enterprise Server, published January 20, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.55%, the 92nd percentile. No source names a fixed version.
References
blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB17118
securityfocus.com/bid/33224
labs.idefense.com/intelligence/vulnerabilities/display.php?id=765
secunia.com/advisories/33534
nvd.nist.gov/vuln/detail/CVE-2009-0176
github.com/advisories/GHSA-42j7-6x8r-f3jv