Published: 31/12/2005 Updated: 19/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows malicious users to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

Vulnerable Product	Search on Vulmon	Subscribe to Product
kde kdegraphics 3.2
kde kdegraphics 3.4.3
easy software products cups 1.1.22
easy software products cups 1.1.22_rc1
kde kpdf 3.2
kde kpdf 3.4.3
tetex tetex 2.0.2
tetex tetex 3.0
kde koffice 1.4
sgi propack 3.0
tetex tetex 1.0.7
libextractor libextractor
kde koffice 1.4.1
kde koffice 1.4.2
tetex tetex 2.0
tetex tetex 2.0.1
easy software products cups 1.1.23
easy software products cups 1.1.23_rc1
kde kword 1.4.2
poppler poppler 0.4.2
xpdf xpdf 3.0
conectiva linux 10.0
debian debian linux 3.0
debian debian linux 3.1
mandrakesoft mandrake linux 10.1
mandrakesoft mandrake linux 10.2
redhat enterprise linux 2.1
redhat enterprise linux 3.0
redhat enterprise linux 4.0
redhat fedora core core_3.0
redhat fedora core core_4.0
redhat linux 7.3
slackware slackware linux 10.1
mandrakesoft mandrake linux corporate server 2.1
redhat enterprise linux desktop 3.0
redhat enterprise linux desktop 4.0
redhat linux advanced workstation 2.1
sco openserver 5.0.7
suse suse linux 1.0
suse suse linux 10.0
suse suse linux 9.1
trustix secure linux 2.0
trustix secure linux 2.2
turbolinux turbolinux home
turbolinux turbolinux multimedia
ubuntu ubuntu linux 4.1
ubuntu ubuntu linux 5.04
gentoo linux
mandrakesoft mandrake linux corporate server 3.0
redhat fedora core core_1.0
redhat fedora core core_2.0
sco openserver 6.0
slackware slackware linux 10.0
suse suse linux 9.0
suse suse linux 9.2
trustix secure linux 3.0
turbolinux turbolinux 10
turbolinux turbolinux personal
turbolinux turbolinux server 10.0
ubuntu ubuntu linux 5.10
slackware slackware linux 10.2
suse suse linux 9.3
turbolinux turbolinux fuji
turbolinux turbolinux appliance server 1.0_hosting_edition
turbolinux turbolinux server 10.0_x86
turbolinux turbolinux server 8.0
mandrakesoft mandrake linux 2006
redhat linux 9.0
slackware slackware linux 9.0
slackware slackware linux 9.1
turbolinux turbolinux appliance server 1.0_workgroup_edition
turbolinux turbolinux desktop 10.0
turbolinux turbolinux workstation 8.0

Debian Bug report logs - #342286 gpdf: source taken from xpdf may introduce heap-overflow vulnerabilities Package: gpdf; Maintainer for gpdf is (unknown); Reported by: Paul Szabo <psz@mathsusydeduau> Date: Tue, 6 Dec 2005 19:48:06 UTC Severity: grave Fixed in version gpdf/2100-2 Done: Filip Van Raemdonck <mecha ...

USN-236-1 fixed several vulnerabilities in xpdf kpdf and kword contain copies of xpdf code and are thus vulnerable to the same issues ...

Chris Evans discovered several integer overflows in the XPDF code, which is present in xpdf, the Poppler library, and tetex-bin By tricking an user into opening a specially crafted PDF file, an attacker could exploit this to execute arbitrary code with the privileges of the application that processes the document ...

Synopsis tetex security update Type/Severity Security Advisory: Moderate Topic Updated tetex packages that fix several integer overflows are now availableThis update has been rated as having moderate security impact by the RedHat Security Response Team Description TeTeX is an implementati ...

Synopsis cups security update Type/Severity Security Advisory: Important Topic Updated CUPS packages that fix multiple security issues are now availablefor Red Hat Enterprise LinuxThis update has been rated as having important security impact by the RedHat Security Response Team Description ...

Synopsis gpdf security update Type/Severity Security Advisory: Important Topic An updated gpdf package that fixes several security issues is now availablefor Red Hat Enterprise Linux 4This update has been rated as having important security impact by the RedHat Security Response Team Description ...

Synopsis xpdf security update Type/Severity Security Advisory: Important Topic An updated xpdf package that fixes several security issues is now availableThis update has been rated as having important security impact by the RedHat Security Response Team[Updated 20 Dec 2005]The initial fix for these issues ...

Synopsis kdegraphics security update Type/Severity Security Advisory: Important Topic Updated kdegraphics packages that resolve several security issues in kpdfare now availableThis update has been rated as having important security impact by the RedHat Security Response Team Description T ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, which is also present in gpdf, the GNOME version of the Portable Document Format viewer, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, that can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code For the old stable distribution (woody) these problems have been fixed in version 100-38 For the stable d ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf which are also present in pdftohtml, a utility that translates PDF documents into HTML format, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable distribution (woody) does not contai ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf which are also present in pdfkitframework, the GNUstep framework for rendering PDF content, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable distribution (woody) does not contain ...

"infamous41md" and Chris Evans discovered several heap based buffer overflows in xpdf which are also present in CUPS, the Common UNIX Printing System, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code For the old stable distribution (woody) these problems have been fixed in version ...

"infamous41md" and chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, which is also present in koffice, the KDE Office Suite, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code The old stable distribution (woody) does not co ...

Get Started

CVE-2005-3625

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect