CVE-2005-3624

Published: 31/12/2005 Updated: 19/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows malicious users to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.

Vulnerable Product	Search on Vulmon	Subscribe to Product
easy software products cups 1.1.22
kde kpdf 3.4.3
kde kdegraphics 3.4.3
tetex tetex 3.0
kde koffice 1.4.1
kde kword 1.4.2
poppler poppler 0.4.2
tetex tetex 1.0.7
sgi propack 3.0
easy software products cups 1.1.23 rc1
kde kdegraphics 3.2
kde koffice 1.4.2
libextractor libextractor
easy software products cups 1.1.22 rc1
xpdf xpdf 3.0
tetex tetex 2.0.2
tetex tetex 2.0.1
conectiva linux 10.0
kde kpdf 3.2
easy software products cups 1.1.23
kde koffice 1.4
tetex tetex 2.0
suse suse linux 9.0
slackware slackware linux 9.0
mandrakesoft mandrake linux 2006
redhat enterprise linux 2.1
debian debian linux 3.1
redhat fedora core core 2.0
turbolinux turbolinux multimedia
redhat enterprise linux 4.0
slackware slackware linux 10.0
slackware slackware linux 10.2
trustix secure linux 2.0
mandrakesoft mandrake linux corporate server 2.1
redhat enterprise linux desktop 3.0
debian debian linux 3.0
suse suse linux 9.1
mandrakesoft mandrake linux 10.2
ubuntu ubuntu linux 4.1
redhat linux advanced workstation 2.1
suse suse linux 10.0
redhat enterprise linux 3.0
suse suse linux 9.3
turbolinux turbolinux appliance server 1.0 workgroup edition
slackware slackware linux 10.1
slackware slackware linux 9.1
trustix secure linux 3.0
redhat fedora core core 1.0
ubuntu ubuntu linux 5.04
ubuntu ubuntu linux 5.10
mandrakesoft mandrake linux 10.1
sco openserver 5.0.7
redhat linux 9.0
suse suse linux 9.2
mandrakesoft mandrake linux corporate server 3.0
redhat fedora core core 4.0
turbolinux turbolinux server 10.0 x86
suse suse linux 1.0
turbolinux turbolinux home
turbolinux turbolinux workstation 8.0
turbolinux turbolinux fuji
turbolinux turbolinux personal
turbolinux turbolinux 10
redhat linux 7.3
sco openserver 6.0
redhat enterprise linux desktop 4.0
trustix secure linux 2.2
turbolinux turbolinux server 8.0
redhat fedora core core 3.0
turbolinux turbolinux server 10.0
gentoo linux
turbolinux turbolinux desktop 10.0
turbolinux turbolinux appliance server 1.0 hosting edition

Debian Bug report logs - #342286 gpdf: source taken from xpdf may introduce heap-overflow vulnerabilities Package: gpdf; Maintainer for gpdf is (unknown); Reported by: Paul Szabo <psz@mathsusydeduau> Date: Tue, 6 Dec 2005 19:48:06 UTC Severity: grave Fixed in version gpdf/2100-2 Done: Filip Van Raemdonck <mecha ...

USN-236-1 fixed several vulnerabilities in xpdf kpdf and kword contain copies of xpdf code and are thus vulnerable to the same issues ...

Chris Evans discovered several integer overflows in the XPDF code, which is present in xpdf, the Poppler library, and tetex-bin By tricking an user into opening a specially crafted PDF file, an attacker could exploit this to execute arbitrary code with the privileges of the application that processes the document ...

Synopsis xpdf security update Type/Severity Security Advisory: Important Topic An updated xpdf package that fixes several security issues is now availableThis update has been rated as having important security impact by the RedHat Security Response Team[Updated 20 Dec 2005]The initial fix for these issues ...

Synopsis tetex security update Type/Severity Security Advisory: Moderate Topic Updated tetex packages that fix several integer overflows are now availableThis update has been rated as having moderate security impact by the RedHat Security Response Team Description TeTeX is an implementati ...

Synopsis cups security update Type/Severity Security Advisory: Important Topic Updated CUPS packages that fix multiple security issues are now availablefor Red Hat Enterprise LinuxThis update has been rated as having important security impact by the RedHat Security Response Team Description ...

Synopsis gpdf security update Type/Severity Security Advisory: Important Topic An updated gpdf package that fixes several security issues is now availablefor Red Hat Enterprise Linux 4This update has been rated as having important security impact by the RedHat Security Response Team Description ...

Synopsis kdegraphics security update Type/Severity Security Advisory: Important Topic Updated kdegraphics packages that resolve several security issues in kpdfare now availableThis update has been rated as having important security impact by the RedHat Security Response Team Description T ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf which are also present in pdfkitframework, the GNUstep framework for rendering PDF content, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable distribution (woody) does not contain ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf which are also present in CUPS, the Common UNIX Printing System, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code For the old stable distribution (woody) these problems have been fixed in version ...

"infamous41md" and chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, which is also present in koffice, the KDE Office Suite, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable distribution (woody) does not co ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, which is also present in gpdf, the GNOME version of the Portable Document Format viewer, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, that can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code For the old stable distribution (woody) these problems have been fixed in version 100-38 For the stable d ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf which are also present in pdftohtml, a utility that translates PDF documents into HTML format, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable distribution (woody) does not contai ...

Get Started

CVE-2005-3624

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect