CVE-2009-1605

moderate-risk

Published 2009-05-11

Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package, as used in SumatraPDF 0.9.3 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF file. NOTE: some of these details are obtained from third party information.

Do I need to act?

7.0% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (13)

Sumatrapdf

Affected Vendors

Sumatrapdfreader

References (10)

Exploit http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0258.html

Vendor Advisory http://secunia.com/advisories/34916

Vendor Advisory http://www.vupen.com/english/advisories/2009/1185

Vendor Advisory http://www.vupen.com/english/advisories/2009/1186

https://bugs.ghostscript.com/show_bug.cgi?id=690555

https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=451373e028f82...

Exploit http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0258.html

Vendor Advisory http://secunia.com/advisories/34916

Vendor Advisory http://www.vupen.com/english/advisories/2009/1185

Vendor Advisory http://www.vupen.com/english/advisories/2009/1186

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 9/34 · Low

Exposure 17/34 · Moderate