CVE-2009-1144: Foolabs Xpdf

Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Untrusted search path vulnerability in the Gentoo package of Xpdf before 3.02-r2 allows local users to gain privileges via a Trojan horse xpdfrc file in the current working directory, related to an unset SYSTEM_XPDFRC macro in a Gentoo build process that uses the poppler library.

Affected products

• Foolabs Xpdf: version 0.5a only; version 0.7a only; version 0.91a only; version 0.91b only; version 0.91c only; version 0.92a only; …
• Glyphandcog Xpdfreader: up to and including 3.02; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; version 0.6 only; …

Published 2009-04-09. Last modified 2026-06-16.