Bug 537471 – CVE-2009-3938 poppler buffer overflow in the ABWOutputDev::endWord function

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 537471 - (CVE-2009-3938) CVE-2009-3938 poppler buffer overflow in the ABWOutputDev::endWord function

Summary:	CVE-2009-3938 poppler buffer overflow in the ABWOutputDev::endWord function

Status:	CLOSED NOTABUG

Aliases:	CVE-2009-3938

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,source=osssecurity,p...
Keywords:	Security

Depends On:	538691
Blocks:
	Show dependency tree / graph

Reported:	2009-11-13 13:57 EST by Josh Bressers
Modified:	2009-11-23 08:51 EST (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2009-11-23 03:15:55 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
FreeDesktop.org	3074	None	None	None	Never

Groups: None (edit)

Description Josh Bressers 2009-11-13 13:57:30 EST

Buffer overflow in the ABWOutputDev::endWord function in
poppler/ABWOutputDev.cc in Poppler (aka libpoppler) 0.10.6, 0.12.0,
and possibly other versions, as used by the Abiword pdftoabw utility,
allows user-assisted remote attackers to cause a denial of service and
possibly execute arbitrary code via a crafted PDF file.


Reference: MISC:http://bugs.freedesktop.org/attachment.cgi?id=30599&action=edit
Reference: CONFIRM:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534680
Reference: CONFIRM:http://bugs.freedesktop.org/show_bug.cgi?id=23074
Reference: BID:36976
Reference: URL:http://www.securityfocus.com/bid/36976
Reference: SECUNIA:37333
Reference: URL:http://secunia.com/advisories/37333
Reference: VUPEN:ADV-2009-3227
Reference: URL:http://www.vupen.com/english/advisories/2009/3227
Reference: XF:poppler-abwoutputdev-bo(54215)
Reference: URL:http://xforce.iss.net/xforce/xfdb/54215

Comment 1 Vincent Danen 2009-11-19 00:00:12 EST

This issue does not affect poppler in Red Hat Enterprise Linux 5; the vulnerable program (pdftoabw) is not present, nor is the vulnerable source file or function.

The program in question was added 2007-04-03 (0.5.9).

This does affect Fedora 10, 11, and 12.

Comment 3 Tomas Hoger 2009-11-23 03:14:37 EST

(In reply to comment #1)

> This does affect Fedora 10, 11, and 12.

I don't see pdftoabw in Fedora poppler packages.  Looking into build logs on F-10 to F-12, I see this in configure summary:

  Building poppler with support for:
    ...
    abiword output:     no

So Fedora is fine too unless packages are rebuilt with abiword support enabled but without a fix.

Comment 4 Rex Dieter 2009-11-23 08:51:37 EST

Thanks for the notice... I'd been tempted to (re)enable abiword output, but will now certainly wait until it can be confirmed to be safe/secure.

Note You need to log in before you can comment on or make changes to this bug.