CVE-2009-3604
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x,...
CVE-2009-3604 is a high vulnerability (CVSS 9.3) in Foolabs Xpdf, published October 21, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.70%, the 95th percentile. Fixed in poppler 0.12.2-1.
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
CVE-2009-3604- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
CVE-2009-3604- Updated
- 2026-11-02
EUVDEUVD-2009-3585 No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
EUVD-2009-3585- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-57v7-6q2r-896j No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x,...
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
GHSA-57v7-6q2r-896j- Updated
- 2026-11-02
OSV No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
CVE-2009-3604- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3604 No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
DEBIAN-CVE-2009-3604- Updated
- 2026-11-02
OSVUBUNTU-CVE-2009-3604 No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
UBUNTU-CVE-2009-3604- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
before 0.12.2-1 | 0.12.2-1 |
popplerDebian:13 |
before 0.12.2-1 | 0.12.2-1 |
popplerDebian:14 |
before 0.12.2-1 | 0.12.2-1 |
xpdfDebian:12 |
before 3.02-2 | 3.02-2 |
xpdfDebian:13 |
before 3.02-2 | 3.02-2 |
xpdfDebian:14 |
before 3.02-2 | 3.02-2 |
popplerDebian:5.0 |
before 0.8.7-3, plus listed versions 0.8.7-10.8.7-2 |
0.8.7-3 |
xpdfDebian:5.0 |
before 3.02-1.4+lenny2, plus listed versions 3.02-1.43.02-1.4+lenny1 |
3.02-1.4+lenny2 |
kdegraphicsDebian:5.0 |
before 4:3.5.9-3+lenny3, plus listed versions 4:3.5.9-34:3.5.9-3+lenny14:3.5.9-3+lenny2 |
4:3.5.9-3+lenny3 |
popplerRed Hat:enterprise_linux:5::client_workstation |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
Show 61 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-develRed Hat:enterprise_linux:5::client_workstation |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
popplerRed Hat:enterprise_linux:5::client |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-debuginfoRed Hat:enterprise_linux:5::client |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-utilsRed Hat:enterprise_linux:5::client |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
popplerRed Hat:enterprise_linux:5::server |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-debuginfoRed Hat:enterprise_linux:5::server |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-develRed Hat:enterprise_linux:5::server |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-utilsRed Hat:enterprise_linux:5::server |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
xpdfRed Hat:enterprise_linux:3::as |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::as |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:3::desktop |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::desktop |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:3::es |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::es |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:3::ws |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::ws |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:4::as |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::as |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdfRed Hat:enterprise_linux:4::desktop |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::desktop |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdfRed Hat:enterprise_linux:4::es |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::es |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdfRed Hat:enterprise_linux:4::ws |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::ws |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
kdegraphicsRed Hat:enterprise_linux:5::client_workstation |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-develRed Hat:enterprise_linux:5::client_workstation |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphicsRed Hat:enterprise_linux:5::client |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:5::client |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphicsRed Hat:rhel_productivity:5 |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-debuginfoRed Hat:rhel_productivity:5 |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-develRed Hat:rhel_productivity:5 |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
gpdfRed Hat:enterprise_linux:4::as |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::as |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdfRed Hat:enterprise_linux:4::desktop |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdfRed Hat:enterprise_linux:4::es |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::es |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdfRed Hat:enterprise_linux:4::ws |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
kdegraphicsRed Hat:enterprise_linux:4::as |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::as |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::as |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphicsRed Hat:enterprise_linux:4::desktop |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::desktop |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::desktop |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphicsRed Hat:enterprise_linux:4::es |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::es |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::es |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphicsRed Hat:enterprise_linux:4::ws |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::ws |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::ws |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
ipeUbuntu:16.04:LTS |
All versions, plus listed versions 7.1.4-2.17.1.8-17.1.10-17.1.10-1.1 |
None known |
ipeUbuntu:18.04:LTS |
All versions, plus listed versions 7.2.7-27.2.7-3 |
None known |
ipeUbuntu:20.04:LTS |
All versions, plus listed versions 7.2.9-17.2.13-27.2.13-2build1 |
None known |
ipeUbuntu:22.04:LTS |
All versions, plus listed versions 7.2.23+dfsg1-27.2.24+dfsg1-17.2.24+dfsg1-1build1 |
None known |
ipeUbuntu:24.04:LTS |
All versions, plus listed versions 7.2.27+dfsg1-27.2.28-27.2.28-2.1build27.2.28-2.1build37.2.28-2.1build4 |
None known |
ipeUbuntu:25.10 |
All versions, plus listed versions 7.2.30-1build1 |
None known |
ipeUbuntu:26.10 |
All versions, plus listed versions 7.2.30-1build27.2.30-2 |
None known |
ipeUbuntu:26.04:LTS |
All versions, plus listed versions 7.2.30-1build17.2.30-1build2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/39938
mandriva.com/security/advisories?name=MDVSA-2009:287
lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html
site.pi3.com.pl/adv/xpdf.txt
Show 128 moreShow less
redhat.com/archives/fedora-package-announce/2009-October/msg00750.html
rhn.redhat.com/errata/RHSA-2009-1501.html
lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
exchange.xforce.ibmcloud.com/vulnerabilities/53795
debian.org/security/2010/dsa-2028
sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1
securitytracker.com/id?1023029
cgit.freedesktop.org/poppler/poppler/diff?id=284a928996&id2=75c3466ba2
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10969
vupen.com/english/advisories/2010/1040
ubuntu.com/usn/USN-850-3
bugzilla.redhat.com/show_bug.cgi?id=526911
securityfocus.com/bid/36703
nvd.nist.gov/vuln/detail/CVE-2009-3604
github.com/advisories/GHSA-57v7-6q2r-896j
security-tracker.debian.org/tracker/CVE-2009-3604
access.redhat.com/errata/RHSA-2009:0480
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0480.json
cve.org/CVERecord?id=CVE-2009-0146
ubuntu.com/security/CVE-2009-3604