CVE-2009-3604
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x,...
9.3 HighFix available
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Exploit likelihood
8.70%Up 2.1 points since Feb 4, 2022
What each source reports
NVD Score used
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
CVE-2009-3604- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
CVE-2009-3604- Updated
- 2026-11-02
EUVDEUVD-2009-3585 No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
EUVD-2009-3585- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-57v7-6q2r-896j No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x,...
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
GHSA-57v7-6q2r-896j- Updated
- 2026-11-02
OSV No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
CVE-2009-3604- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3604 No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
DEBIAN-CVE-2009-3604- Updated
- 2026-11-02
OSVUBUNTU-CVE-2009-3604 No score
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
- Record
UBUNTU-CVE-2009-3604- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
popplerDebian:12 |
before 0.12.2-1 | 0.12.2-1 |
popplerDebian:13 |
before 0.12.2-1 | 0.12.2-1 |
popplerDebian:14 |
before 0.12.2-1 | 0.12.2-1 |
xpdfDebian:12 |
before 3.02-2 | 3.02-2 |
xpdfDebian:13 |
before 3.02-2 | 3.02-2 |
xpdfDebian:14 |
before 3.02-2 | 3.02-2 |
popplerDebian:5.0 From an advisory covering 10 CVEs |
before 0.8.7-3, plus listed versions 0.8.7-10.8.7-2 |
0.8.7-3 |
xpdfDebian:5.0 From an advisory covering 6 CVEs |
before 3.02-1.4+lenny2, plus listed versions 3.02-1.43.02-1.4+lenny1 |
3.02-1.4+lenny2 |
kdegraphicsDebian:5.0 From an advisory covering 6 CVEs |
before 4:3.5.9-3+lenny3, plus listed versions 4:3.5.9-34:3.5.9-3+lenny14:3.5.9-3+lenny2 |
4:3.5.9-3+lenny3 |
popplerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
Show 61 moreShow less
| Package | Affected | Fixed |
|---|---|---|
poppler-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
popplerRed Hat:enterprise_linux:5::client From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-utilsRed Hat:enterprise_linux:5::client From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
popplerRed Hat:enterprise_linux:5::server From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-develRed Hat:enterprise_linux:5::server From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
poppler-utilsRed Hat:enterprise_linux:5::server From an advisory covering 16 CVEs |
before 0:0.5.4-4.4.el5_3.9 | 0:0.5.4-4.4.el5_3.9 |
xpdfRed Hat:enterprise_linux:3::as From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:3::es From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdf-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 4 CVEs |
before 1:2.02-17.el3 | 1:2.02-17.el3 |
xpdfRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdfRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdfRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdfRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
xpdf-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs |
before 1:3.00-22.el4_8.1 | 1:3.00-22.el4_8.1 |
kdegraphicsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphicsRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphicsRed Hat:rhel_productivity:5 From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-debuginfoRed Hat:rhel_productivity:5 From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
kdegraphics-develRed Hat:rhel_productivity:5 From an advisory covering 6 CVEs |
before 7:3.5.4-15.el5_4.2 | 7:3.5.4-15.el5_4.2 |
gpdfRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdfRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdfRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdfRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
gpdf-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs |
before 0:2.8.2-7.7.2.el4_8.5 | 0:2.8.2-7.7.2.el4_8.5 |
kdegraphicsRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphicsRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphicsRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphicsRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
kdegraphics-develRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs |
before 7:3.3.1-15.el4_8.2 | 7:3.3.1-15.el4_8.2 |
ipeUbuntu:16.04:LTS |
All versions, plus listed versions 7.1.4-2.17.1.8-17.1.10-17.1.10-1.1 |
None known |
ipeUbuntu:18.04:LTS |
All versions, plus listed versions 7.2.7-27.2.7-3 |
None known |
ipeUbuntu:20.04:LTS |
All versions, plus listed versions 7.2.9-17.2.13-27.2.13-2build1 |
None known |
ipeUbuntu:22.04:LTS |
All versions, plus listed versions 7.2.23+dfsg1-27.2.24+dfsg1-17.2.24+dfsg1-1build1 |
None known |
ipeUbuntu:24.04:LTS |
All versions, plus listed versions 7.2.27+dfsg1-27.2.28-27.2.28-2.1build27.2.28-2.1build37.2.28-2.1build4 |
None known |
ipeUbuntu:25.10 |
All versions, plus listed versions 7.2.30-1build1 |
None known |
ipeUbuntu:26.10 |
All versions, plus listed versions 7.2.30-1build27.2.30-2 |
None known |
ipeUbuntu:26.04:LTS |
All versions, plus listed versions 7.2.30-1build17.2.30-1build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3604 is a high vulnerability (CVSS 9.3) in Foolabs Xpdf, published October 21, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.70%, the 95th percentile. Fixed in poppler 0.12.2-1.
References
secunia.com/advisories/39938
mandriva.com/security/advisories?name=MDVSA-2009:287
lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html
site.pi3.com.pl/adv/xpdf.txt
Show 128 moreShow less
redhat.com/archives/fedora-package-announce/2009-October/msg00750.html
rhn.redhat.com/errata/RHSA-2009-1501.html
lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
exchange.xforce.ibmcloud.com/vulnerabilities/53795
debian.org/security/2010/dsa-2028
sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1
securitytracker.com/id?1023029
cgit.freedesktop.org/poppler/poppler/diff?id=284a928996&id2=75c3466ba2
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10969
vupen.com/english/advisories/2010/1040
ubuntu.com/usn/USN-850-3
bugzilla.redhat.com/show_bug.cgi?id=526911
securityfocus.com/bid/36703
nvd.nist.gov/vuln/detail/CVE-2009-3604
github.com/advisories/GHSA-57v7-6q2r-896j
security-tracker.debian.org/tracker/CVE-2009-3604
access.redhat.com/errata/RHSA-2009:0480
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0480.json
cve.org/CVERecord?id=CVE-2009-0146
ubuntu.com/security/CVE-2009-3604