Back to Database
Status published
Medium
CVE-2009-1144
Untrusted search path vulnerability in the Gentoo package of Xpdf...
Vulnerability Description
Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-1144
Credits & Attribution
No credits recorded in the NVD database.
References
More from foolabs
View All →CVE-2009-3609
Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf...
Medium
4.3
CVE-2009-3608
Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf...
Critical
9.3
CVE-2009-3606
Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4,...
Critical
9.3
CVE-2009-3604
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x...
Critical
9.3
CVE-2009-3603
Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before...
Critical
9.3
Affected Vendor
foolabs
View all reports →Affected Software
xpdf, xpdfreader
Vulnerable Versions:
0.5a, 0.7a, 0.91a, 0.91b, 0.91c, 0.92a, 0.92b, 0.92c, 0.92d, 0.92e, 0.93a, 0.93b, 0.93c, 1.00a, 0, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.80, 0.90, 0.91, 0.93, 1.00, 1.01, 2.00, 2.01, 2.02, 2.03, 3.00
Timeline
Official Publish:
April 9th, 2009
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.