PT-2005-1037 · Thomas Esser+4 · Tetex+5

Chris Evans · Publicado 2005-12-06 · Atualizado 2024-06-15 · CVE-2005-3624

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics versions prior to 3.4.3-r3 pdftohtml (affected versions not specified)

Description The issue involves multiple vulnerabilities in certain packages, including kdegraphics and pdftohtml, which can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Specifically, the CCITTFaxStream::CCITTFaxStream function in Stream.cc for various packages, including xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, leading to integer overflows and underflows.

Recommendations For kdegraphics versions prior to 3.4.3-r3, update to version 3.4.3-r3 or later. For pdftohtml, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-189

Identificadores relacionados

BDU:2015-03279

BDU:2015-09484

CVE-2005-3624

DSA-931-1

DSA-932-1

DSA-936-1

DSA-937-1

DSA-938-1

DSA-940-1

DSA-950-1

DSA-961-1

DSA-962-1

DTSA-28-1

OPENSUSE-SU-2024:10707-1

RHSA-2005:840

RHSA-2005:868

RHSA-2005_840

RHSA-2005_868

RHSA-2006:0160

RHSA-2006:0163

RHSA-2006:0177

RHSA-2006_0160

RHSA-2006_0163

RHSA-2006_0177

Produtos afetados

Cups

Red Hat

Gpdf

Kdegraphics

Kpdf

Tetex

Referências · 141

• 🔥 http://scary.beasts.org/security/CESA-2005-003.txt · Exploit
• http://secunia.com/advisories/18334 · Nota
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2006:012 · Aviso do Fabricante
• http://secunia.com/advisories/18428 · Nota
• https://access.redhat.com/security/cve/CVE-2005-3627 · Nota
• https://suse.com/security/cve/CVE-2021-25317 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2006:010 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3624 · Nota de Segurança
• https://redhat.com/security/data/cve/CVE-2005-3625.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627 · Nota de Segurança
• http://secunia.com/advisories/19230 · Nota
• https://redhat.com/security/data/cve/CVE-2005-3193.html · Nota
• http://secunia.com/advisories/18385 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-5393 · Nota