Ubuntu 4.10 / 5.04 / 5.10 : xpdf/cupsys/tetex-bin/kdegraphics/koffice vulnerabilities (USN-227-1)

Ubuntu Security Notice (C) 2005-2015 Canonical, Inc. / NASL script (C) 2006-2015 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

infamous41md discovered several integer overflows in the XPDF code,
which is present in xpdf, the Poppler library, tetex-bin, KOffice, and
kpdf. By tricking an user into opening a specially crafted PDF file,
an attacker could exploit this to execute arbitrary code with the
privileges of the application that processes the document.

The CUPS printing system also uses XPDF code to convert PDF files to
PostScript. By attempting to print such a crafted PDF file, a remote
attacker could execute arbitrary code with the privileges of the
printer server (user 'cupsys').

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 6.5
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 20770 ()

Bugtraq ID: 15721
15725
15726
15727

CVE ID: CVE-2005-3191
CVE-2005-3192
CVE-2005-3193