CVE-2009-1183
UnknownEPSS 3.77%
Last modified
CVE-2009-1183 is a vulnerability of currently unknown severity. The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.. EPSS estimates a 3.77% chance of exploitation in the next 30 days.
Description
The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Foolabs | Xpdf | 0.5a |
| Foolabs | Xpdf | 0.7a |
| Foolabs | Xpdf | 0.91a |
| Foolabs | Xpdf | 0.91b |
| Foolabs | Xpdf | 0.91c |
| Foolabs | Xpdf | 0.92a |
| Foolabs | Xpdf | 0.92b |
| Foolabs | Xpdf | 0.92c |
| Foolabs | Xpdf | 0.92d |
| Foolabs | Xpdf | 0.92e |
| Foolabs | Xpdf | 0.93a |
| Foolabs | Xpdf | 0.93b |
| Foolabs | Xpdf | 0.93c |
| Foolabs | Xpdf | 1.00a |
| Glyphandcog | Xpdfreader | <= 3.02 |
| Glyphandcog | Xpdfreader | 0.2 |
| Glyphandcog | Xpdfreader | 0.3 |
| Glyphandcog | Xpdfreader | 0.4 |
| Glyphandcog | Xpdfreader | 0.5 |
| Glyphandcog | Xpdfreader | 0.6 |
| Glyphandcog | Xpdfreader | 0.7 |
| Glyphandcog | Xpdfreader | 0.80 |
| Glyphandcog | Xpdfreader | 0.90 |
| Glyphandcog | Xpdfreader | 0.91 |
| Glyphandcog | Xpdfreader | 0.92 |
| Glyphandcog | Xpdfreader | 0.93 |
| Glyphandcog | Xpdfreader | 1.00 |
| Glyphandcog | Xpdfreader | 1.01 |
| Glyphandcog | Xpdfreader | 2.00 |
| Glyphandcog | Xpdfreader | 2.01 |
| Glyphandcog | Xpdfreader | 2.02 |
| Glyphandcog | Xpdfreader | 2.03 |
| Glyphandcog | Xpdfreader | 3.00 |
| Glyphandcog | Xpdfreader | 3.01 |
| Poppler | Poppler | <= 0.10.5 |
| Poppler | Poppler | 0.1 |
| Poppler | Poppler | 0.1.1 |
| Poppler | Poppler | 0.1.2 |
| Poppler | Poppler | 0.2.0 |
| Poppler | Poppler | 0.3.0 |
| Poppler | Poppler | 0.3.1 |
| Poppler | Poppler | 0.3.2 |
| Poppler | Poppler | 0.3.3 |
| Poppler | Poppler | 0.4.0 |
| Poppler | Poppler | 0.4.1 |
| Poppler | Poppler | 0.4.2 |
| Poppler | Poppler | 0.4.3 |
| Poppler | Poppler | 0.4.4 |
| Poppler | Poppler | 0.5.0 |
| Poppler | Poppler | 0.5.1 |
Showing 50 of 138 affected configurations. See NVD for the full list.
References
- http://poppler.freedesktop.org/releases.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/34291Vendor Advisory
- http://secunia.com/advisories/34481Vendor Advisory
- http://secunia.com/advisories/34746Vendor Advisory
- http://secunia.com/advisories/34755Vendor Advisory
- http://secunia.com/advisories/34756Vendor Advisory
- http://secunia.com/advisories/34852Vendor Advisory
- http://secunia.com/advisories/34959Vendor Advisory
- http://secunia.com/advisories/34963Vendor Advisory
- http://secunia.com/advisories/34991Vendor Advisory
- http://secunia.com/advisories/35037Vendor Advisory
- http://secunia.com/advisories/35064Vendor Advisory
- http://secunia.com/advisories/35065Vendor Advisory
- http://secunia.com/advisories/35618Vendor Advisory
- http://secunia.com/advisories/35685Vendor Advisory
- http://www.kb.cert.org/vuls/id/196617US Government Resource
- http://www.vupen.com/english/advisories/2009/1065Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1066Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1076Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1077Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1040Vendor Advisory
- http://poppler.freedesktop.org/releases.htmlPatch, Vendor Advisory
- http://secunia.com/advisories/34291Vendor Advisory
- http://secunia.com/advisories/34481Vendor Advisory
- http://secunia.com/advisories/34746Vendor Advisory
- http://secunia.com/advisories/34755Vendor Advisory
- http://secunia.com/advisories/34756Vendor Advisory
- http://secunia.com/advisories/34852Vendor Advisory
- http://secunia.com/advisories/34959Vendor Advisory
- http://secunia.com/advisories/34963Vendor Advisory
- http://secunia.com/advisories/34991Vendor Advisory
- http://secunia.com/advisories/35037Vendor Advisory
- http://secunia.com/advisories/35064Vendor Advisory
- http://secunia.com/advisories/35065Vendor Advisory
- http://secunia.com/advisories/35618Vendor Advisory
- http://secunia.com/advisories/35685Vendor Advisory
- http://www.kb.cert.org/vuls/id/196617US Government Resource
- http://www.vupen.com/english/advisories/2009/1065Patch, Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1066Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1076Vendor Advisory
- http://www.vupen.com/english/advisories/2009/1077Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1040Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-1183?
The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.
How severe is CVE-2009-1183?
Severity scoring for CVE-2009-1183 is pending analysis. The EPSS model estimates a 3.77% probability of exploitation in the next 30 days.
How do I fix CVE-2009-1183?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-1177Multiple stack-based buffer overflows in maptemplate.c in ma…
- CVE-2009-1178Unspecified vulnerability in the server in IBM Tivoli Storag…
- CVE-2009-1179Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and ea…
- CVE-2009-1180The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 an…
- CVE-2009-1181The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 an…
- CVE-2009-1182Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3…
- CVE-2009-1184The selinux_ip_postroute_iptables_compat function in securit…
- CVE-2009-1185udev before 1.4.1 does not verify whether a NETLINK message …
- CVE-2009-1186Buffer overflow in the util_path_encode function in udev/lib…
- CVE-2009-1187Integer overflow in the JBIG2 decoding feature in Poppler be…
- CVE-2009-1188Integer overflow in the JBIG2 decoding feature in the Splash…
- CVE-2009-1189The _dbus_validate_signature_with_reason function (dbus-mars…
Are you affected by CVE-2009-1183?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST