CVE-2009-0147

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.

Published: 2009-04-23 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2009-0147 is rated Moderate Risk (51.7/100): CVSS Medium severity, with high exploitation likelihood (EPSS 5.33%, 90th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +2.94% over the last day, indicating growing attacker interest. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2009-0147

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-08 2.38% 5.33% +2.94%
2 2026-01-06 1.67% 2.38% +0.71%
3 2025-12-14 — 1.67% —

Full EPSS history (12 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2009-0147

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.6 2.9 [email protected]

Weakness enumeration for CVE-2009-0147

OS Trackers for CVE-2009-0147

vendor priority summary link
debian medium CVE-2009-0147 medium priority: Debian including 3 source packages (cups, poppler, xpdf), 15 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 15. https://security-tracker.debian.org/tracker/CVE-2009-0147
gentoo normal CVE-2009-0147: 2 GLSA(s) (200904-20, 201310-03), 2 atom(s) (app-text/poppler, net-print/cups); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2009-0147
redhat high — https://access.redhat.com/security/cve/CVE-2009-0147
ubuntu medium CVE-2009-0147 medium priority: Ubuntu including 14 source packages (cups, cupsys, …), 280 status rows across 20 suites (dapper, gutsy, hardy, intrepid, jaunty, karmic, lucid, maverick, natty, oneiric, precise, quantal, raring, saucy, trusty, upstream, utopic, vivid, wily, xenial): DNE 116, not-affected 93, ignored 37, released 24, needs-triage 10. https://ubuntu.com/security/CVE-2009-0147

Affected software / configurations for CVE-2009-0147

Vendor Product Version Raw CPE
foolabs xpdf 0.5a cpe:2.3:a:foolabs:xpdf:0.5a:*:*:*:*:*:*:*
foolabs xpdf 0.7a cpe:2.3:a:foolabs:xpdf:0.7a:*:*:*:*:*:*:*
foolabs xpdf 0.91a cpe:2.3:a:foolabs:xpdf:0.91a:*:*:*:*:*:*:*
foolabs xpdf 0.91b cpe:2.3:a:foolabs:xpdf:0.91b:*:*:*:*:*:*:*
foolabs xpdf 0.91c cpe:2.3:a:foolabs:xpdf:0.91c:*:*:*:*:*:*:*
foolabs xpdf 0.92a cpe:2.3:a:foolabs:xpdf:0.92a:*:*:*:*:*:*:*
foolabs xpdf 0.92b cpe:2.3:a:foolabs:xpdf:0.92b:*:*:*:*:*:*:*
foolabs xpdf 0.92c cpe:2.3:a:foolabs:xpdf:0.92c:*:*:*:*:*:*:*
foolabs xpdf 0.92d cpe:2.3:a:foolabs:xpdf:0.92d:*:*:*:*:*:*:*
foolabs xpdf 0.92e cpe:2.3:a:foolabs:xpdf:0.92e:*:*:*:*:*:*:*
foolabs xpdf 0.93a cpe:2.3:a:foolabs:xpdf:0.93a:*:*:*:*:*:*:*
foolabs xpdf 0.93b cpe:2.3:a:foolabs:xpdf:0.93b:*:*:*:*:*:*:*
foolabs xpdf 0.93c cpe:2.3:a:foolabs:xpdf:0.93c:*:*:*:*:*:*:*
foolabs xpdf 1.00a cpe:2.3:a:foolabs:xpdf:1.00a:*:*:*:*:*:*:*
glyphandcog xpdfreader <= 3.02 cpe:2.3:a:glyphandcog:xpdfreader:*:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.2 cpe:2.3:a:glyphandcog:xpdfreader:0.2:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.3 cpe:2.3:a:glyphandcog:xpdfreader:0.3:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.4 cpe:2.3:a:glyphandcog:xpdfreader:0.4:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.5 cpe:2.3:a:glyphandcog:xpdfreader:0.5:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.6 cpe:2.3:a:glyphandcog:xpdfreader:0.6:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.7 cpe:2.3:a:glyphandcog:xpdfreader:0.7:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.80 cpe:2.3:a:glyphandcog:xpdfreader:0.80:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.90 cpe:2.3:a:glyphandcog:xpdfreader:0.90:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.91 cpe:2.3:a:glyphandcog:xpdfreader:0.91:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.92 cpe:2.3:a:glyphandcog:xpdfreader:0.92:*:*:*:*:*:*:*
glyphandcog xpdfreader 0.93 cpe:2.3:a:glyphandcog:xpdfreader:0.93:*:*:*:*:*:*:*
glyphandcog xpdfreader 1.00 cpe:2.3:a:glyphandcog:xpdfreader:1.00:*:*:*:*:*:*:*
glyphandcog xpdfreader 1.01 cpe:2.3:a:glyphandcog:xpdfreader:1.01:*:*:*:*:*:*:*
glyphandcog xpdfreader 2.00 cpe:2.3:a:glyphandcog:xpdfreader:2.00:*:*:*:*:*:*:*
glyphandcog xpdfreader 2.01 cpe:2.3:a:glyphandcog:xpdfreader:2.01:*:*:*:*:*:*:*
glyphandcog xpdfreader 2.02 cpe:2.3:a:glyphandcog:xpdfreader:2.02:*:*:*:*:*:*:*
glyphandcog xpdfreader 2.03 cpe:2.3:a:glyphandcog:xpdfreader:2.03:*:*:*:*:*:*:*
glyphandcog xpdfreader 3.00 cpe:2.3:a:glyphandcog:xpdfreader:3.00:*:*:*:*:*:*:*
glyphandcog xpdfreader 3.01 cpe:2.3:a:glyphandcog:xpdfreader:3.01:*:*:*:*:*:*:*
apple cups <= 1.3.9 cpe:2.3:a:apple:cups:*:*:*:*:*:*:*:*
apple cups 1.1 cpe:2.3:a:apple:cups:1.1:*:*:*:*:*:*:*
apple cups 1.1.1 cpe:2.3:a:apple:cups:1.1.1:*:*:*:*:*:*:*
apple cups 1.1.2 cpe:2.3:a:apple:cups:1.1.2:*:*:*:*:*:*:*
apple cups 1.1.3 cpe:2.3:a:apple:cups:1.1.3:*:*:*:*:*:*:*
apple cups 1.1.4 cpe:2.3:a:apple:cups:1.1.4:*:*:*:*:*:*:*
apple cups 1.1.5 cpe:2.3:a:apple:cups:1.1.5:*:*:*:*:*:*:*
apple cups 1.1.5-1 cpe:2.3:a:apple:cups:1.1.5-1:*:*:*:*:*:*:*
apple cups 1.1.5-2 cpe:2.3:a:apple:cups:1.1.5-2:*:*:*:*:*:*:*
apple cups 1.1.6 cpe:2.3:a:apple:cups:1.1.6:*:*:*:*:*:*:*
apple cups 1.1.6-1 cpe:2.3:a:apple:cups:1.1.6-1:*:*:*:*:*:*:*
apple cups 1.1.6-2 cpe:2.3:a:apple:cups:1.1.6-2:*:*:*:*:*:*:*
apple cups 1.1.6-3 cpe:2.3:a:apple:cups:1.1.6-3:*:*:*:*:*:*:*
apple cups 1.1.7 cpe:2.3:a:apple:cups:1.1.7:*:*:*:*:*:*:*
apple cups 1.1.8 cpe:2.3:a:apple:cups:1.1.8:*:*:*:*:*:*:*
apple cups 1.1.9 cpe:2.3:a:apple:cups:1.1.9:*:*:*:*:*:*:*
apple cups 1.1.9-1 cpe:2.3:a:apple:cups:1.1.9-1:*:*:*:*:*:*:*
apple cups 1.1.10 cpe:2.3:a:apple:cups:1.1.10:*:*:*:*:*:*:*
apple cups 1.1.10-1 cpe:2.3:a:apple:cups:1.1.10-1:*:*:*:*:*:*:*
apple cups 1.1.11 cpe:2.3:a:apple:cups:1.1.11:*:*:*:*:*:*:*
apple cups 1.1.12 cpe:2.3:a:apple:cups:1.1.12:*:*:*:*:*:*:*
apple cups 1.1.13 cpe:2.3:a:apple:cups:1.1.13:*:*:*:*:*:*:*
apple cups 1.1.14 cpe:2.3:a:apple:cups:1.1.14:*:*:*:*:*:*:*
apple cups 1.1.15 cpe:2.3:a:apple:cups:1.1.15:*:*:*:*:*:*:*
apple cups 1.1.16 cpe:2.3:a:apple:cups:1.1.16:*:*:*:*:*:*:*
apple cups 1.1.17 cpe:2.3:a:apple:cups:1.1.17:*:*:*:*:*:*:*
apple cups 1.1.18 cpe:2.3:a:apple:cups:1.1.18:*:*:*:*:*:*:*
apple cups 1.1.19 cpe:2.3:a:apple:cups:1.1.19:*:*:*:*:*:*:*
apple cups 1.1.19 cpe:2.3:a:apple:cups:1.1.19:rc1:*:*:*:*:*:*
apple cups 1.1.19 cpe:2.3:a:apple:cups:1.1.19:rc2:*:*:*:*:*:*
apple cups 1.1.19 cpe:2.3:a:apple:cups:1.1.19:rc3:*:*:*:*:*:*
apple cups 1.1.19 cpe:2.3:a:apple:cups:1.1.19:rc4:*:*:*:*:*:*
apple cups 1.1.19 cpe:2.3:a:apple:cups:1.1.19:rc5:*:*:*:*:*:*
apple cups 1.1.20 cpe:2.3:a:apple:cups:1.1.20:*:*:*:*:*:*:*
apple cups 1.1.20 cpe:2.3:a:apple:cups:1.1.20:rc1:*:*:*:*:*:*
apple cups 1.1.20 cpe:2.3:a:apple:cups:1.1.20:rc2:*:*:*:*:*:*
apple cups 1.1.20 cpe:2.3:a:apple:cups:1.1.20:rc3:*:*:*:*:*:*
apple cups 1.1.20 cpe:2.3:a:apple:cups:1.1.20:rc4:*:*:*:*:*:*
apple cups 1.1.20 cpe:2.3:a:apple:cups:1.1.20:rc5:*:*:*:*:*:*
apple cups 1.1.20 cpe:2.3:a:apple:cups:1.1.20:rc6:*:*:*:*:*:*
apple cups 1.1.21 cpe:2.3:a:apple:cups:1.1.21:*:*:*:*:*:*:*
apple cups 1.1.21 cpe:2.3:a:apple:cups:1.1.21:rc1:*:*:*:*:*:*
apple cups 1.1.21 cpe:2.3:a:apple:cups:1.1.21:rc2:*:*:*:*:*:*
apple cups 1.1.22 cpe:2.3:a:apple:cups:1.1.22:*:*:*:*:*:*:*
apple cups 1.1.22 cpe:2.3:a:apple:cups:1.1.22:rc1:*:*:*:*:*:*
apple cups 1.1.22 cpe:2.3:a:apple:cups:1.1.22:rc2:*:*:*:*:*:*

References for CVE-2009-0147

URL Tags
http://bugs.gentoo.org/show_bug.cgi?id=263028
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html
http://rhn.redhat.com/errata/RHSA-2009-0458.html
http://secunia.com/advisories/34291 Vendor Advisory
http://secunia.com/advisories/34481 Vendor Advisory
http://secunia.com/advisories/34755 Vendor Advisory
http://secunia.com/advisories/34756 Vendor Advisory
http://secunia.com/advisories/34852 Vendor Advisory
http://secunia.com/advisories/34959 Vendor Advisory
http://secunia.com/advisories/34963 Vendor Advisory
http://secunia.com/advisories/34991 Vendor Advisory
http://secunia.com/advisories/35037 Vendor Advisory
http://secunia.com/advisories/35064 Vendor Advisory
http://secunia.com/advisories/35065 Vendor Advisory
http://secunia.com/advisories/35074 Vendor Advisory
http://secunia.com/advisories/35618 Vendor Advisory
http://secunia.com/advisories/35685 Vendor Advisory
http://security.gentoo.org/glsa/glsa-200904-20.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.578477
http://support.apple.com/kb/HT3549
http://support.apple.com/kb/HT3639
http://wiki.rpath.com/Advisories:rPSA-2009-0059
http://wiki.rpath.com/Advisories:rPSA-2009-0061
http://www.debian.org/security/2009/dsa-1790
http://www.debian.org/security/2009/dsa-1793
http://www.mandriva.com/security/advisories?name=MDVSA-2009:101
http://www.mandriva.com/security/advisories?name=MDVSA-2010:087
http://www.redhat.com/support/errata/RHSA-2009-0429.html
http://www.redhat.com/support/errata/RHSA-2009-0430.html Patch
http://www.redhat.com/support/errata/RHSA-2009-0431.html
http://www.redhat.com/support/errata/RHSA-2009-0480.html
http://www.securityfocus.com/archive/1/502750/100/0/threaded
http://www.securityfocus.com/archive/1/502761/100/0/threaded
http://www.securityfocus.com/bid/34568
http://www.securitytracker.com/id?1022073
http://www.us-cert.gov/cas/techalerts/TA09-133A.html US Government Resource
http://www.vupen.com/english/advisories/2009/1065 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1066 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1077 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1297 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1621 Vendor Advisory
http://www.vupen.com/english/advisories/2010/1040 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=490614
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9941
https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00567.html
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01277.html
https://www.redhat.com/archives/fedora-package-announce/2009-June/msg01291.html
cvelogic Threat Intelligence