Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2009-4035 Details

Description

The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and possibly other libraries and versions, does not check the return value of the getNextLine function, which allows context-dependent attackers to execute arbitrary code via a PDF file with a crafted Type 1 font that can produce a negative value, leading to a signed-to-unsigned integer conversion error and a buffer overflow.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://cgit.freedesktop.org/poppler/poppler/diff/fofi/FoFiType1.cc?id=4b4fc5c0 CVE
http://cgit.freedesktop.org/poppler/poppler/tree/fofi/FoFiType1.cc?id=4b4fc5c017bf147c9069bbce32fc14467bd2a81a CVE
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00003.html CVE
https://bugzilla.redhat.com/show_bug.cgi?id=541614 CVE
http://secunia.com/advisories/37641 CVEVendor Advisory

see all 32 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-94Improper Control of Generation of Code ('Code Injection')[email protected]

Affected Products

ProductVersions
gnome gpdf
2.8.2

CPE

  • cpe:2.3:a:gnome:gpdf:2.8.2:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
kde kdegraphics
3.3.1

CPE

  • cpe:2.3:a:kde:kdegraphics:3.3.1:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
kde kpdf
3.3.1

CPE

  • cpe:2.3:a:kde:kpdf:3.3.1:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
xpdf xpdf
3.0.0

CPE

  • cpe:2.3:a:xpdf:xpdf:3.0.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2009-4035
NVD Published Date:
Dec 21, 2009
NVD Last Modified:
Jun 16, 2026
Source:
[email protected]
CVE-2009-4035 Details - Not Deferred