CVE-2005-3628

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.

References

ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U

http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html

http://secunia.com/advisories/18147

http://secunia.com/advisories/18380

http://secunia.com/advisories/18385

http://secunia.com/advisories/18387

http://secunia.com/advisories/18389

http://secunia.com/advisories/18398

http://secunia.com/advisories/18407

http://secunia.com/advisories/18416

http://secunia.com/advisories/18428

http://secunia.com/advisories/18436

http://secunia.com/advisories/18534

http://secunia.com/advisories/18582

http://secunia.com/advisories/18674

http://secunia.com/advisories/18675

http://secunia.com/advisories/18679

http://secunia.com/advisories/18908

http://secunia.com/advisories/18913

http://secunia.com/advisories/19230

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747

http://www.debian.org/security/2005/dsa-931

http://www.debian.org/security/2005/dsa-932

http://www.debian.org/security/2005/dsa-937

http://www.debian.org/security/2005/dsa-938

http://www.debian.org/security/2005/dsa-940

http://www.debian.org/security/2006/dsa-936

http://www.debian.org/security/2006/dsa-950

http://www.debian.org/security/2006/dsa-961

http://www.debian.org/security/2006/dsa-962

http://www.mandriva.com/security/advisories?name=MDKSA-2006:010

http://www.mandriva.com/security/advisories?name=MDKSA-2006:011

http://www.mandriva.com/security/advisories?name=MDKSA-2006:012

http://www.redhat.com/support/errata/RHSA-2006-0160.html

http://www.securityfocus.com/archive/1/427053/100/0/threaded

http://www.securityfocus.com/archive/1/427990/100/0/threaded

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10287

Details

Source: MITRE

Published: 2005-12-31

Updated: 2018-10-19

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:xpdf:xpdf:*:*:*:*:*:*:*:*

Tenable Plugins

View all (26 total)

IDNameProductFamilySeverity
22828Debian DSA-962-1 : pdftohtml - buffer overflowsNessusDebian Local Security Checks
critical
22827Debian DSA-961-1 : pdfkit.framework - buffer overflowsNessusDebian Local Security Checks
critical
22816Debian DSA-950-1 : cupsys - buffer overflowsNessusDebian Local Security Checks
critical
22806Debian DSA-940-1 : gpdf - buffer overflowsNessusDebian Local Security Checks
critical
22804Debian DSA-938-1 : koffice - buffer overflowsNessusDebian Local Security Checks
critical
22803Debian DSA-937-1 : tetex-bin - buffer overflowsNessusDebian Local Security Checks
critical
22802Debian DSA-936-1 : libextractor - buffer overflowsNessusDebian Local Security Checks
critical
22798Debian DSA-932-1 : kdegraphics - buffer overflowsNessusDebian Local Security Checks
critical
22797Debian DSA-931-1 : xpdf - buffer overflowsNessusDebian Local Security Checks
critical
21972CentOS 4 : kdegraphics (CESA-2005:868)NessusCentOS Local Security Checks
critical
21971CentOS 4 : gpdf (CESA-2005:867)NessusCentOS Local Security Checks
high
21885CentOS 3 / 4 : tetex (CESA-2006:0160)NessusCentOS Local Security Checks
critical
21876CentOS 3 / 4 : cups (CESA-2005:878)NessusCentOS Local Security Checks
high
21873CentOS 3 / 4 : xpdf (CESA-2005:840)NessusCentOS Local Security Checks
critical
20920Slackware 10.0 / 10.1 / 10.2 / 9.0 / 9.1 / current : xpdf (SSA:2006-045-09)NessusSlackware Local Security Checks
critical
20915Slackware 10.0 / 10.1 / 10.2 / current : kdegraphics (SSA:2006-045-04)NessusSlackware Local Security Checks
critical
20752RHEL 2.1 / 3 / 4 : tetex (RHSA-2006:0160)NessusRed Hat Local Security Checks
critical
20478Mandrake Linux Security Advisory : kdegraphics (MDKSA-2006:012)NessusMandriva Local Security Checks
critical
20477Mandrake Linux Security Advisory : tetex (MDKSA-2006:011)NessusMandriva Local Security Checks
critical
20476Mandrake Linux Security Advisory : cups (MDKSA-2006:010)NessusMandriva Local Security Checks
critical
20474Mandrake Linux Security Advisory : koffice (MDKSA-2006:008)NessusMandriva Local Security Checks
critical
20412GLSA-200601-02 : KPdf, KWord: Multiple overflows in included Xpdf codeNessusGentoo Local Security Checks
critical
20365RHEL 3 / 4 : cups (RHSA-2005:878)NessusRed Hat Local Security Checks
high
20363RHEL 4 : kdegraphics (RHSA-2005:868)NessusRed Hat Local Security Checks
critical
20362RHEL 4 : gpdf (RHSA-2005:867)NessusRed Hat Local Security Checks
high
20268RHEL 2.1 / 3 / 4 : xpdf (RHSA-2005:840)NessusRed Hat Local Security Checks
critical