UnratedFix available
poppler, xpdf — security advisory
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
- Products
- poppler, xpdf
- Affected versions
- Not specified
- Fixed versions
- 0.10.6-1, 3.02-1.4+lenny1
- CVEs
- CVE-2009-1179
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:41 UTC · Revision 1
Source evidence
Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
osv:DEBIAN-CVE-2009-1179
poppler
Fixed versions: 0.10.6-1
poppler
Fixed versions: 0.10.6-1
poppler
Fixed versions: 0.10.6-1
xpdf
Fixed versions: 3.02-1.4+lenny1
xpdf
Fixed versions: 3.02-1.4+lenny1
xpdf
Fixed versions: 3.02-1.4+lenny1
Complete source record
{
"id": "dfe6f1c4f04695eb0b5b24d5dba34d3ac645e1b54476ccd939528365ce5ba3e3",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2009-1179",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2009-1179",
"summary": "Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.",
"evidence": "osv:DEBIAN-CVE-2009-1179",
"products": [
{
"name": {
"value": "poppler",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02-1.4+lenny1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02-1.4+lenny1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02-1.4+lenny1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2009-1179",
"aliases": [
"DEBIAN-CVE-2009-1179"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1179.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1179.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1179.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02-1.4+lenny1"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1179.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02-1.4+lenny1"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1179.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02-1.4+lenny1"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1179.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
}
],
"modified": "2026-10-23T17:47:27.609003289Z",
"provider": "osv",
"upstream": [
"CVE-2009-1179"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2009-1179"
]
},
"related_cves": [
{
"value": "CVE-2009-1179",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 417042,
"published_at": "2009-04-23T17:30:01.75+00:00"
}