漏洞信息详情

Xpdf和Poppler SplashBitmap::SplashBitmap()函数整数溢出漏洞

• CNNVD编号：CNNVD-200910-366
• 危害等级： 中危
  
• CVE编号： CVE-2009-3603
• 漏洞类型： 数字错误
• 发布时间： 2009-10-21
• 威胁类型： 远程
• 更新时间： 2019-04-02
• 厂        商： poppler
• 漏洞来源： Adam Zabrocki pi3...

漏洞简介

Xpdf是一个开发源码的PDF文件查看器，运行于X Window以及Motif上。

Xpdf的SplashBitmap：：SplashBitmap()函数中存在一个整数溢出漏洞。攻击者通过构造特定的PDF文件以触发整数溢出，导致Xpdf文件查看器崩溃或执行任意代码。

漏洞公告

厂商目前已经发布了升级补丁以修复此安全问题，补丁获取链接：

http://www.foolabs.com/xpdf/ https://www.redhat.com/support/errata/RHSA-2009-1500.HTML

参考网址

来源:SECTRACK

链接:http://securitytracker.com/id?1023029

来源:SUNALERT

链接:http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1

来源:CONFIRM

链接:https://bugzilla.redhat.com/show_bug.cgi?id=526915

来源:SECUNIA

链接:http://secunia.com/advisories/37034

来源:MANDRIVA

链接:http://www.mandriva.com/security/advisories?name=MDVSA-2009:287

来源:SECUNIA

链接:http://secunia.com/advisories/37114

来源:FEDORA

链接:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.HTML

来源:SECUNIA

链接:http://secunia.com/advisories/37053

来源:SECUNIA

链接:http://secunia.com/advisories/37054

来源:XF

链接:https://exchange.xforce.ibmcloud.com/vulnerabilities/53793

来源:BID

链接:http://www.securityfocus.com/bid/36703

来源:SECUNIA

链接:http://secunia.com/advisories/39327

来源:DEBIAN

链接:http://www.debian.org/security/2010/dsa-2050

来源:FEDORA

链接:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.HTML

来源:UBUNTU

链接:http://www.ubuntu.com/usn/USN-850-1

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2010/1220

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2010/1040

来源:REDHAT

链接:https://rhn.redhat.com/errata/RHSA-2009-1504.HTML

来源:FEDORA

链接:https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00784.HTML

来源:FEDORA

链接:http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.HTML

来源:MANDRIVA

链接:http://www.mandriva.com/security/advisories?name=MDVSA-2011:175

来源:FEDORA

链接:https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00750.HTML

来源:SUSE

链接:http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.HTML

来源:SECUNIA

链接:http://secunia.com/advisories/39938

来源:OVAL

链接:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9671

来源:SECUNIA

链接:http://secunia.com/advisories/37159

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2010/0802

来源:SUNALERT

链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1

来源:CONFIRM

链接:http://poppler.freedesktop.org/

来源:MANDRIVA

链接:http://www.mandriva.com/security/advisories?name=MDVSA-2010:087

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2009/2925

来源:VUPEN

链接:http://www.vupen.com/english/advisories/2009/2924

来源:DEBIAN

链接:http://www.debian.org/security/2010/dsa-2028

来源:UBUNTU

链接:http://www.ubuntu.com/usn/USN-850-3

受影响实体

• Poppler Poppler:0.9.2  
• Poppler Poppler:0.9.3  
• Poppler Poppler:0.12.0  
• Poppler Poppler:0.8.7  
• Poppler Poppler:0.9.0  

补丁

暂无