Xpdf 'FoFiType1::parse' Buffer Overflow Vulnerability

Bugtraq ID:	37350
Class:	Boundary Condition Error
CVE:	CVE-2009-4035
Remote:	Yes
Local:	No
Published:	Dec 16 2009 12:00AM
Updated:	Feb 18 2014 05:17AM
Credit:	Petr Gajdos and Christian Kornacker
Vulnerable:	Xpdf Xpdf 3.0 pl3 Xpdf Xpdf 3.0 pl2 Xpdf Xpdf 3.0 1pl1 Xpdf Xpdf 3.0 1 Xpdf Xpdf 3.0 0 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Red Hat Fedora Core3 + Red Hat Fedora Core2 + Red Hat Fedora Core2 + Red Hat Fedora Core2 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 10.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32 SuSE SUSE Linux Enterprise Server SDK 9 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 11 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Server 10 SP3 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise Desktop 11 SuSE SUSE Linux Enterprise Desktop 10 SP3 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop version 4 Red Hat Enterprise Linux AS 4 Gentoo Linux
Not Vulnerable:	Xpdf Xpdf 3.01 + Debian Linux 4.0 sparc + Debian Linux 4.0 s/390 + Debian Linux 4.0 powerpc + Debian Linux 4.0 mipsel + Debian Linux 4.0 mips + Debian Linux 4.0 m68k + Debian Linux 4.0 ia-64 + Debian Linux 4.0 ia-32 + Debian Linux 4.0 hppa + Debian Linux 4.0 arm + Debian Linux 4.0 amd64 + Debian Linux 4.0 alpha + Debian Linux 4.0 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 x86_64 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.1 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Red Hat Fedora Core3 + Red Hat Fedora Core2 + Red Hat Fedora Core2 + Red Hat Fedora Core2 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 10.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32

Xpdf 'FoFiType1::parse' Buffer Overflow Vulnerability

Xpdf is prone to a buffer-overflow vulnerability.

Exploits may allow remote attackers to execute arbitrary code in the context of an affected application or cause denial-of-service conditions.

Xpdf 'FoFiType1::parse' Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Xpdf 'FoFiType1::parse' Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for details.

Xpdf 'FoFiType1::parse' Buffer Overflow Vulnerability

References:

• Bug 541614 - (CVE-2009-4035) CVE-2009-4035 xpdf: buffer overflow in FoFiType1::p (Red Hat)
  
• Poppler Homepage (Poppler)
  
• Xpdf Homepage (Xpdf)
  
• diff --git a/fofi/FoFiType1.cc b/fofi/FoFiType1.cc (Poppler)