ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl4.patch

http://cgit.freedesktop.org/poppler/poppler/commit/?id=9cf2325fb2

http://cgit.freedesktop.org/poppler/poppler/diff/?id=284a928996&id2=75c3466ba2

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035340.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035399.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035408.html

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html

http://secunia.com/advisories/37023

http://secunia.com/advisories/37028

http://secunia.com/advisories/37037

http://secunia.com/advisories/37042

http://secunia.com/advisories/37043

http://secunia.com/advisories/37053

http://secunia.com/advisories/37077

http://secunia.com/advisories/37079

http://secunia.com/advisories/37114

http://secunia.com/advisories/37159

http://secunia.com/advisories/39327

http://secunia.com/advisories/39938

http://securitytracker.com/id?1023029

http://site.pi3.com.pl/adv/xpdf.txt

http://sunsolve.sun.com/search/document.do?assetkey=1-66-274030-1

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021706.1-1

http://www.debian.org/security/2010/dsa-2028

http://www.debian.org/security/2010/dsa-2050

http://www.mandriva.com/security/advisories?name=MDVSA-2009:287

http://www.mandriva.com/security/advisories?name=MDVSA-2010:087

http://www.mandriva.com/security/advisories?name=MDVSA-2011:175

http://www.securityfocus.com/bid/36703

http://www.ubuntu.com/usn/USN-850-1

http://www.ubuntu.com/usn/USN-850-3

http://www.vupen.com/english/advisories/2009/2924

http://www.vupen.com/english/advisories/2009/2928

http://www.vupen.com/english/advisories/2010/0802

http://www.vupen.com/english/advisories/2010/1040

http://www.vupen.com/english/advisories/2010/1220

https://bugzilla.redhat.com/show_bug.cgi?id=526911

https://exchange.xforce.ibmcloud.com/vulnerabilities/53795

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10969

https://rhn.redhat.com/errata/RHSA-2009-1500.html

https://rhn.redhat.com/errata/RHSA-2009-1501.html

https://rhn.redhat.com/errata/RHSA-2009-1502.html

https://rhn.redhat.com/errata/RHSA-2009-1503.html

https://rhn.redhat.com/errata/RHSA-2009-1512.html

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00750.html

https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00784.html

CVE-2009-3604 xpdf/poppler: Splash::drawImage integer overflow and missing allocation return value check

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.

Red Hat, Inc. (AV:N/AC:M/Au:N/C:P/I:P/A:P)

https://access.redhat.com/errata/RHSA-2009:0480 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1500 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1501 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1502 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1503 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1512 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2009-3604 [No Types Assigned]

Victim must voluntarily interact with attack mechanism

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.

CVE-2009-3604 xpdf/poppler: Splash::drawImage integer overflow and missing allocation return value check

Red Hat, Inc. (AV:N/AC:M/Au:N/C:P/I:P/A:P)

https://access.redhat.com/errata/RHSA-2009:0480 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1500 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1501 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1502 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1503 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2009:1512 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2009-3604 [No Types Assigned]

OR
     *cpe:2.3:a:foolabs:xpdf:2.02:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:glyphandcog:xpdfreader:2.02:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:foolabs:xpdf:3.02:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:glyphandcog:xpdfreader:3.02:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:foolabs:xpdf:2.00:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:glyphandcog:xpdfreader:2.00:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:foolabs:xpdf:2.01:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:glyphandcog:xpdfreader:2.01:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:foolabs:xpdf:2.03:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:glyphandcog:xpdfreader:2.03:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:foolabs:xpdf:3.00:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:glyphandcog:xpdfreader:3.00:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:foolabs:xpdf:3.01:*:*:*:*:*:*:*

OR
     *cpe:2.3:a:glyphandcog:xpdfreader:3.01:*:*:*:*:*:*:*

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10969 [No Types Assigned]

http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10969 [No Types Assigned]

https://exchange.xforce.ibmcloud.com/vulnerabilities/53795 [No Types Assigned]

http://xforce.iss.net/xforce/xfdb/53795 [No Types Assigned]