CVE-2009-3607
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in...
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-3607- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-3607- Updated
- 2026-11-02
EUVDEUVD-2009-3588 No score
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
- Record
EUVD-2009-3588- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9rq-9gxv-4m5h No score
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in...
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
- Record
GHSA-x9rq-9gxv-4m5h- Updated
- 2026-11-02
OSVBELL-CVE-2009-3607
CVE-2009-3607 does not affect BellSoft software
- Record
BELL-CVE-2009-3607- CVSS 2.0
- 9.3 Critical
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
OSV No score
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
- Record
CVE-2009-3607- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3607 No score
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.
- Record
DEBIAN-CVE-2009-3607- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10360-1 No score
libpoppler-cpp0-0.49.0-1.1 on GA media
These are all security issues fixed in the libpoppler-cpp0-0.49.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10360-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
before 0.12.2-1 | 0.12.2-1 |
popplerDebian:13 |
before 0.12.2-1 | 0.12.2-1 |
popplerDebian:14 |
before 0.12.2-1 | 0.12.2-1 |
popplerDebian:5.0 From an advisory covering 10 CVEs |
before 0.8.7-3, plus listed versions 0.8.7-10.8.7-2 |
0.8.7-3 |
poppleropenSUSE:Tumbleweed From an advisory covering 16 CVEs |
before 0.49.0-1.1 | 0.49.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3607 is a high vulnerability (CVSS 9.3) in Poppler, published October 21, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.91%, the 93rd percentile. Fixed in poppler 0.12.2-1.
References
debian.org/security/2009/dsa-1941
openwall.com/lists/oss-security/2009/12/01/6
redhat.com/archives/fedora-package-announce/2009-October/msg00750.html
securityfocus.com/bid/36718
exchange.xforce.ibmcloud.com/vulnerabilities/53801
Show 34 moreShow less
secunia.com/advisories/37159
bugzilla.redhat.com/show_bug.cgi?id=526924
sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1
mandriva.com/security/advisories?name=MDVSA-2011:175
ubuntu.com/usn/USN-850-3
cgit.freedesktop.org/poppler/poppler/commit?id=c839b706
vupen.com/english/advisories/2009/2925
nvd.nist.gov/vuln/detail/CVE-2009-3607
access.redhat.com/security/cve/CVE-2009-3607
github.com/advisories/GHSA-x9rq-9gxv-4m5h
docs.bell-sw.com/security/cves/CVE-2009-3607
security-tracker.debian.org/tracker/CVE-2009-3607
suse.com/security/cve/CVE-2009-0799