CVE catalog

CVE-2009-0165

xpdf: CVE-2009-0165

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.59% · Oct 25, 2026

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as used in Poppler and other products, when running on Mac OS X, has unspecified impact, related to "g*allocn."

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxpdfsid3.04+git20260802-1fixed
Debianxpdfforky3.04+git20260802-1fixed
Debianxpdftrixie3.04+git20250304-1fixed
Debianxpdfbookworm3.04+git20220601-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxpdfsourcesid3.02-1.4+lenny1lowNot reported[524809]
Debianxpdfsourceforky3.02-1.4+lenny1lowNot reported[524809]
Debianxpdfsourcetrixie3.02-1.4+lenny1lowNot reported[524809]
Debianxpdfsourcebookworm3.02-1.4+lenny1lowNot reported[524809]

[Debian bug #524809]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [xpdf]Fixed

    Source package: [xpdf]

    Details (2)

    • 3.04+git20220601-1+b2 · amd64 · bookworm

      Fixed · Fixed: 3.02-1.4+lenny1

      dsa · xpdf · debian · bookworm; dsa · xpdf · debian · 12

    • 3.04+git20220601-1+b2 · arm64 · bookworm

      Fixed · Fixed: 3.02-1.4+lenny1

      dsa · xpdf · debian · bookworm; dsa · xpdf · debian · 12

[Debian 13 (Trixie)]

  • [xpdf]Fixed

    Source package: [xpdf]

    Details (2)

    • 3.04+git20250304-1+b1 · amd64 · trixie

      Fixed · Fixed: 3.02-1.4+lenny1

      dsa · xpdf · debian · 13

    • 3.04+git20250304-1+b1 · arm64 · trixie

      Fixed · Fixed: 3.02-1.4+lenny1

      dsa · xpdf · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]