CVE-2009-0147: Apple Cups

Medium severity, CVSS 4.3. EPSS: 2.6% chance of exploitation in the next 30 days.

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.

Affected products

• Apple Cups: up to and including 1.3.9; version 1.1 only; version 1.1.1 only; version 1.1.2 only; version 1.1.3 only; version 1.1.4 only; …
• Foolabs Xpdf: version 0.5a only; version 0.7a only; version 0.91a only; version 0.91b only; version 0.91c only; version 0.92a only; …
• Glyphandcog Xpdfreader: up to and including 3.02; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; version 0.6 only; …

Published 2009-04-23. Last modified 2026-06-16.