# CVE-2009-3604: gir1.2-poppler-0.18: The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before3.02pl4, and Poppler 0.x, as used in GPdf and k...

CVE-2009-3604 is fixed in 9 products on 1 platform, first by gir1.2-poppler-0.18 0.12.2-2.1ubuntu1, released October 21, 2009. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2009-3604
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0870
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 21, 2009

## Description

The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does notproperly allocate memory, which allows remote attackers to cause a denialof service (application crash) or possibly execute arbitrary code via acrafted PDF document that triggers a NULL pointer dereference or aheap-based buffer overflow.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | gir1.2-poppler-0.18 Ubuntu 24.10 (oracular) | 0.12.2-2.1ubuntu1 | [gir1.2-poppler-0.18 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-gir1.2-poppler-0.18-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | gir1.2-poppler-0.18 Ubuntu 25.04 (plucky) | 0.12.2-2.1ubuntu1 | [gir1.2-poppler-0.18 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-gir1.2-poppler-0.18-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-cpp0t64 Ubuntu 24.10 (oracular) | 0.12.2-2.1ubuntu1 | [libpoppler-cpp0t64 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libpoppler-cpp0t64-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-cpp1 Ubuntu 25.04 (plucky) | 0.12.2-2.1ubuntu1 | [libpoppler-cpp1 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libpoppler-cpp1-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-glib8t64 Ubuntu 24.10 (oracular) | 0.12.2-2.1ubuntu1 | [libpoppler-glib8t64 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libpoppler-glib8t64-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-glib8t64 Ubuntu 25.04 (plucky) | 0.12.2-2.1ubuntu1 | [libpoppler-glib8t64 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libpoppler-glib8t64-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-qt5-1t64 Ubuntu 24.10 (oracular) | 0.12.2-2.1ubuntu1 | [libpoppler-qt5-1t64 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libpoppler-qt5-1t64-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-qt5-1t64 Ubuntu 25.04 (plucky) | 0.12.2-2.1ubuntu1 | [libpoppler-qt5-1t64 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libpoppler-qt5-1t64-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-qt6-3t64 Ubuntu 24.10 (oracular) | 0.12.2-2.1ubuntu1 | [libpoppler-qt6-3t64 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libpoppler-qt6-3t64-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler-qt6-3t64 Ubuntu 25.04 (plucky) | 0.12.2-2.1ubuntu1 | [libpoppler-qt6-3t64 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libpoppler-qt6-3t64-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler134 Ubuntu 24.10 (oracular) | 0.12.2-2.1ubuntu1 | [libpoppler134 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libpoppler134-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | libpoppler140 Ubuntu 25.04 (plucky) | 0.12.2-2.1ubuntu1 | [libpoppler140 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libpoppler140-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | poppler-utils Ubuntu 24.10 (oracular) | 0.12.2-2.1ubuntu1 | [poppler-utils 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-poppler-utils-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |
| Linux | poppler-utils Ubuntu 25.04 (plucky) | 0.12.2-2.1ubuntu1 | [poppler-utils 0.12.2-2.1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-poppler-utils-0.12.2-2.1ubuntu1.md) | Oct 21, 2009 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo