UnratedFix available
poppler, xpdf — security advisory
Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
- Products
- poppler, xpdf
- Affected versions
- Not specified
- Fixed versions
- 0.10.6-1, 3.02-1.4+lenny1
- CVEs
- CVE-2009-1182
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:35 UTC · Revision 1
Source evidence
Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
osv:DEBIAN-CVE-2009-1182
poppler
Fixed versions: 0.10.6-1
poppler
Fixed versions: 0.10.6-1
poppler
Fixed versions: 0.10.6-1
xpdf
Fixed versions: 3.02-1.4+lenny1
xpdf
Fixed versions: 3.02-1.4+lenny1
xpdf
Fixed versions: 3.02-1.4+lenny1
Complete source record
{
"id": "a4715dd7e37dc262a5aac4e825e04911e0ad7ed59465e67cf42f9429e37f0f32",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2009-1182",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2009-1182",
"summary": "Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.",
"evidence": "osv:DEBIAN-CVE-2009-1182",
"products": [
{
"name": {
"value": "poppler",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "poppler",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.10.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02-1.4+lenny1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02-1.4+lenny1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "xpdf",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.02-1.4+lenny1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2009-1182",
"aliases": [
"DEBIAN-CVE-2009-1182"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1182.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1182.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.6-1"
}
]
}
],
"package": {
"name": "poppler",
"purl": "pkg:deb/debian/poppler?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1182.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02-1.4+lenny1"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1182.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02-1.4+lenny1"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1182.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.02-1.4+lenny1"
}
]
}
],
"package": {
"name": "xpdf",
"purl": "pkg:deb/debian/xpdf?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1182.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
}
],
"modified": "2026-10-23T17:47:25.153417479Z",
"provider": "osv",
"upstream": [
"CVE-2009-1182"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2009-1182"
]
},
"related_cves": [
{
"value": "CVE-2009-1182",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 416826,
"published_at": "2009-04-23T17:30:01.813+00:00"
}