CVE-2005-3627

HIGH

Description

Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.

References

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt

ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U

ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U

ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U

http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html

http://rhn.redhat.com/errata/RHSA-2006-0177.html

http://scary.beasts.org/security/CESA-2005-003.txt

http://secunia.com/advisories/18147

http://secunia.com/advisories/18303

http://secunia.com/advisories/18312

http://secunia.com/advisories/18313

http://secunia.com/advisories/18329

http://secunia.com/advisories/18332

http://secunia.com/advisories/18334

http://secunia.com/advisories/18335

http://secunia.com/advisories/18338

http://secunia.com/advisories/18349

http://secunia.com/advisories/18373

http://secunia.com/advisories/18375

http://secunia.com/advisories/18380

http://secunia.com/advisories/18385

http://secunia.com/advisories/18387

http://secunia.com/advisories/18389

http://secunia.com/advisories/18398

http://secunia.com/advisories/18407

http://secunia.com/advisories/18414

http://secunia.com/advisories/18416

http://secunia.com/advisories/18423

http://secunia.com/advisories/18425

http://secunia.com/advisories/18428

http://secunia.com/advisories/18436

http://secunia.com/advisories/18448

http://secunia.com/advisories/18463

http://secunia.com/advisories/18517

http://secunia.com/advisories/18534

http://secunia.com/advisories/18554

http://secunia.com/advisories/18582

http://secunia.com/advisories/18642

http://secunia.com/advisories/18644

http://secunia.com/advisories/18674

http://secunia.com/advisories/18675

http://secunia.com/advisories/18679

http://secunia.com/advisories/18908

http://secunia.com/advisories/18913

http://secunia.com/advisories/19230

http://secunia.com/advisories/19377

http://secunia.com/advisories/25729

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1

http://www.debian.org/security/2005/dsa-931

http://www.debian.org/security/2005/dsa-932

http://www.debian.org/security/2005/dsa-937

http://www.debian.org/security/2005/dsa-938

http://www.debian.org/security/2005/dsa-940

http://www.debian.org/security/2006/dsa-936

http://www.debian.org/security/2006/dsa-950

http://www.debian.org/security/2006/dsa-961

http://www.debian.org/security/2006/dsa-962

http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml

http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml

http://www.kde.org/info/security/advisory-20051207-2.txt

http://www.mandriva.com/security/advisories?name=MDKSA-2006:003

http://www.mandriva.com/security/advisories?name=MDKSA-2006:004

http://www.mandriva.com/security/advisories?name=MDKSA-2006:005

http://www.mandriva.com/security/advisories?name=MDKSA-2006:006

http://www.mandriva.com/security/advisories?name=MDKSA-2006:008

http://www.mandriva.com/security/advisories?name=MDKSA-2006:010

http://www.mandriva.com/security/advisories?name=MDKSA-2006:011

http://www.mandriva.com/security/advisories?name=MDKSA-2006:012

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00030.html

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00031.html

http://www.redhat.com/support/errata/RHSA-2006-0160.html

http://www.redhat.com/support/errata/RHSA-2006-0163.html

http://www.securityfocus.com/archive/1/427053/100/0/threaded

http://www.securityfocus.com/archive/1/427990/100/0/threaded

http://www.securityfocus.com/bid/16143

http://www.trustix.org/errata/2006/0002/

http://www.vupen.com/english/advisories/2006/0047

http://www.vupen.com/english/advisories/2007/2280

https://exchange.xforce.ibmcloud.com/vulnerabilities/24024

https://exchange.xforce.ibmcloud.com/vulnerabilities/24025

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10200

https://usn.ubuntu.com/236-1/

Details

Source: MITRE

Published: 2005-12-31

Updated: 2018-10-19

Type: CWE-119

Risk Information

CVSS v2.0

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:xpdf:xpdf:*:*:*:*:*:*:*:*

Tenable Plugins

View all (42 total)

IDNameProductFamilySeverity
62251Fedora Core 3 : tetex-2.0.2-21.7.FC3 (2005-029)NessusFedora Local Security Checks
critical
62250Fedora Core 4 : tetex-3.0-9.FC4 (2005-028)NessusFedora Local Security Checks
critical
22828Debian DSA-962-1 : pdftohtml - buffer overflowsNessusDebian Local Security Checks
critical
22827Debian DSA-961-1 : pdfkit.framework - buffer overflowsNessusDebian Local Security Checks
critical
22816Debian DSA-950-1 : cupsys - buffer overflowsNessusDebian Local Security Checks
critical
22806Debian DSA-940-1 : gpdf - buffer overflowsNessusDebian Local Security Checks
critical
22804Debian DSA-938-1 : koffice - buffer overflowsNessusDebian Local Security Checks
critical
22803Debian DSA-937-1 : tetex-bin - buffer overflowsNessusDebian Local Security Checks
critical
22802Debian DSA-936-1 : libextractor - buffer overflowsNessusDebian Local Security Checks
critical
22798Debian DSA-932-1 : kdegraphics - buffer overflowsNessusDebian Local Security Checks
critical
22797Debian DSA-931-1 : xpdf - buffer overflowsNessusDebian Local Security Checks
critical
21989CentOS 4 : kdegraphics (CESA-2006:0262)NessusCentOS Local Security Checks
high
21980CentOS 4 : gpdf (CESA-2006:0177)NessusCentOS Local Security Checks
critical
21972CentOS 4 : kdegraphics (CESA-2005:868)NessusCentOS Local Security Checks
critical
21886CentOS 3 / 4 : cups (CESA-2006:0163)NessusCentOS Local Security Checks
critical
21885CentOS 3 / 4 : tetex (CESA-2006:0160)NessusCentOS Local Security Checks
critical
21873CentOS 3 / 4 : xpdf (CESA-2005:840)NessusCentOS Local Security Checks
critical
21043RHEL 4 : kdegraphics (RHSA-2006:0262)NessusRed Hat Local Security Checks
high
20920Slackware 10.0 / 10.1 / 10.2 / 9.0 / 9.1 / current : xpdf (SSA:2006-045-09)NessusSlackware Local Security Checks
critical
20915Slackware 10.0 / 10.1 / 10.2 / current : kdegraphics (SSA:2006-045-04)NessusSlackware Local Security Checks
critical
20829GLSA-200601-17 : Xpdf, Poppler, GPdf, libextractor, pdftohtml: Heap overflowsNessusGentoo Local Security Checks
critical
20782Ubuntu 5.04 / 5.10 : kdegraphics, koffice vulnerabilities (USN-236-2)NessusUbuntu Local Security Checks
critical
20781Ubuntu 4.10 / 5.04 / 5.10 : xpdf, poppler, cupsys, tetex-bin vulnerabilities (USN-236-1)NessusUbuntu Local Security Checks
critical
20752RHEL 2.1 / 3 / 4 : tetex (RHSA-2006:0160)NessusRed Hat Local Security Checks
critical
20482RHEL 4 : gpdf (RHSA-2006:0177)NessusRed Hat Local Security Checks
critical
20481RHEL 3 / 4 : cups (RHSA-2006:0163)NessusRed Hat Local Security Checks
critical
20478Mandrake Linux Security Advisory : kdegraphics (MDKSA-2006:012)NessusMandriva Local Security Checks
critical
20477Mandrake Linux Security Advisory : tetex (MDKSA-2006:011)NessusMandriva Local Security Checks
critical
20476Mandrake Linux Security Advisory : cups (MDKSA-2006:010)NessusMandriva Local Security Checks
critical
20474Mandrake Linux Security Advisory : koffice (MDKSA-2006:008)NessusMandriva Local Security Checks
critical
20412GLSA-200601-02 : KPdf, KWord: Multiple overflows in included Xpdf codeNessusGentoo Local Security Checks
critical
20410Fedora Core 3 : tetex-2.0.2-21.7.FC3 (2006-029)NessusFedora Local Security Checks
critical
20409Fedora Core 4 : tetex-3.0-9.FC4 (2006-028)NessusFedora Local Security Checks
critical
20407Fedora Core 4 : poppler-0.4.4-1.1 (2006-026)NessusFedora Local Security Checks
critical
20406Fedora Core 3 : gpdf-2.8.2-7.2 (2006-025)NessusFedora Local Security Checks
critical
20396Fedora Core 3 2005-000: cupsNessusFedora Local Security Checks
high
20363RHEL 4 : kdegraphics (RHSA-2005:868)NessusRed Hat Local Security Checks
critical
20268RHEL 2.1 / 3 / 4 : xpdf (RHSA-2005:840)NessusRed Hat Local Security Checks
critical
16167Fedora Core 2 : kernel-2.6.10-1.9_FC2 (2005-026)NessusFedora Local Security Checks
critical
16166Fedora Core 3 : kernel-2.6.10-1.741_FC3 (2005-025)NessusFedora Local Security Checks
critical
801566Fedora 2005-026 Security CheckLog Correlation EngineGeneric
high
801565Fedora 2005-025 Security CheckLog Correlation EngineGeneric
high