The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2007:0731 advisory.

  - xpdf integer overflow (CVE-2007-3387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0 to fix an integer overflow.

It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.

libextractor includes a copy of the xpdf code and required an update as well.

Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause kpdf to crash and possibly execute arbitrary code open a user opening the file.

This update provides packages which are patched to prevent these issues.

It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.

kpdf includes a copy of the xpdf code and required an update as well.

The remote host is affected by the vulnerability described in GLSA-200709-17 (teTeX: Multiple buffer overflows)

    Mark Richters discovered a buffer overflow in the open_sty() function     in file mkind.c. Other vulnerabilities have also been discovered in the     same file but might not be exploitable (CVE-2007-0650). Tetex also     includes vulnerable code from GD library (GLSA 200708-05), and from     Xpdf (CVE-2007-3387).
  Impact :

    A remote attacker could entice a user to process a specially crafted     PNG, GIF or PDF file, or to execute 'makeindex' on an overly long     filename. In both cases, this could lead to the remote execution of     arbitrary code with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

This update fixes a security problem concerning PDF handling.

It also fixes printing speed with USB printers, and includes a fix for the LSPP support.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri Aug 10 2007 Jindrich Novy <jnovy at redhat.com>     3.0-40.1

    - backport upstream fix for xpdf integer overflow       CVE-2007-3387 (#251514)

    - don't mess up file contexts while running texhash       (#235032)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This is an update to address a vulnerability in kpdf, one that can cause a stack based buffer overflow.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-496-1 fixed a vulnerability in koffice. This update provides the corresponding updates for poppler, the library used for PDF handling in Gnome.

Derek Noonburg discovered an integer overflow in the Xpdf function StreamPredictor::StreamPredictor(). By importing a specially crafted PDF file into KWord, this could be exploited to run arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code.
(CVE-2007-3387)

Maurycy Prodeus discovered an integer overflow flaw in the way CUPS processes PDF files. An attacker could create a malicious PDF file that could potentially execute arbitrary code when printed.
(CVE-2007-3387)

Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause an application linked with poppler to crash or potentially execute arbitrary code when opened. (CVE-2007-3387)

ID	Name	Product	Family	Published	Updated	Severity
25829	RHEL 4 / 5 : tetex (RHSA-2007:0731)	Nessus	Red Hat Local Security Checks	8/1/2007	4/21/2024	high
25848	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 9.1 : xpdf (SSA:2007-222-05)	Nessus	Slackware Local Security Checks	8/13/2007	1/14/2021	medium
25857	Debian DSA-1349-1 : libextractor - integer overflow	Nessus	Debian Local Security Checks	8/13/2007	1/4/2021	medium
25894	Mandrake Linux Security Advisory : kdegraphics (MDKSA-2007:162)	Nessus	Mandriva Local Security Checks	8/15/2007	1/6/2021	medium
25936	Debian DSA-1355-1 : kdegraphics - integer overflow	Nessus	Debian Local Security Checks	8/28/2007	1/4/2021	medium
26215	GLSA-200709-17 : teTeX: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	10/3/2007	1/6/2021	medium
27720	Fedora 7 : cups-1.2.12-4.fc7 (2007-1541)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	medium
27721	Fedora 7 : tetex-3.0-40.1.fc7 (2007-1547)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	medium
27723	Fedora 7 : kdegraphics-3.5.7-2.fc7 (2007-1594)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	medium
28099	Ubuntu 6.06 LTS / 6.10 / 7.04 : poppler vulnerability (USN-496-2)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	medium
29480	SuSE 10 Security Update : kdegraphics3-pdf (ZYPP Patch Number 3968)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	medium
60232	Scientific Linux Security Update : cups on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
60235	Scientific Linux Security Update : poppler on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium

Detections

Analytics

Plugins Search

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium