PT-2005-1038 · Foxtail Technology+3 · Xpdf+3

Chris Evans · Publicado 2005-12-06 · Atualizado 2018-10-19 · CVE-2005-3625

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics versions prior to 3.4.3-r3 pdftohtml (affected versions not specified) Xpdf (affected versions not specified)

Description The issue affects multiple components, including kdegraphics and pdftohtml, allowing remote exploitation that may lead to confidentiality, integrity, and availability breaches. Specifically, Xpdf is vulnerable to a denial of service (infinite loop) via prematurely ended streams, such as CCITTFaxDecode and DCTDecode streams.

Recommendations For kdegraphics versions prior to 3.4.3-r3, update to version 3.4.3-r3 or later. For pdftohtml, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Xpdf, consider disabling the use of CCITTFaxDecode and DCTDecode streams until a patch is available.

Exploit

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-399

CWE-119

Identificadores relacionados

BDU:2015-03279

BDU:2015-09484

CVE-2005-3625

DSA-931-1

DSA-932-1

DSA-936-1

DSA-937-1

DSA-938-1

DSA-940-1

DSA-950-1

DSA-961-1

DSA-962-1

DTSA-28-1

RHSA-2005:840

RHSA-2005:868

RHSA-2005_840

RHSA-2005_868

RHSA-2006:0160

RHSA-2006:0163

RHSA-2006:0177

RHSA-2006_0160

RHSA-2006_0163

RHSA-2006_0177

Produtos afetados

Red Hat

Xpdf

Kdegraphics

Pdftohtml

Referências · 123

• 🔥 http://scary.beasts.org/security/CESA-2005-003.txt · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2005-3627 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2006:010 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627 · Nota de Segurança
• http://secunia.com/advisories/19230 · Nota
• http://secunia.com/advisories/18385 · Aviso do Fabricante
• http://secunia.com/advisories/18375 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-03279 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDKSA-2006:005 · Aviso do Fabricante
• https://redhat.com/security/data/cve/CVE-2005-3627.html · Nota
• https://access.redhat.com/errata/RHSA-2006:0160 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2005-3626 · Nota
• https://access.redhat.com/security/cve/CVE-2005-3191 · Nota