PT-2005-3038 · Kpdf+2 · Kpdf+2

Chris Evans + 1 · Publicado 2005-08-09 · Atualizado 2018-10-19 · CVE-2005-2097

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: xpdf (affected versions not specified) kpdf (affected versions not specified)

Description: The issue arises from improper validation of the "loca" table in PDF files, allowing local users to cause a denial of service. This can be achieved by creating a PDF file with a "broken" loca table, which in turn causes xpdf to create a large temporary file when attempting to reconstruct the information, resulting in disk consumption and hang.

Recommendations: For xpdf, consider implementing proper validation of the "loca" table in PDF files to prevent the creation of large temporary files. For kpdf, apply similar validation measures to the "loca" table to mitigate the risk of denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2005-2097

DSA-1136-1

DSA-780-1

DSA-936-1

DSA-982-1

DSA-984-1

DTSA-28-1

RHSA-2005:670

RHSA-2005:671

RHSA-2005:706

RHSA-2005:708

RHSA-2005_670

RHSA-2005_671

RHSA-2005_706

RHSA-2005_708

Produtos afetados

Red Hat

Kpdf

Xpdf

Referências · 31

• https://redhat.com/security/data/cve/CVE-2005-2097.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-2097 · Aviso do Fabricante
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2005-2097 · Aviso do Fabricante
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.42/SCOSA-2005.42.txt · Aviso do Fabricante
• http://debian.org/security/2006/dsa-1136 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2005-670.html · Aviso do Fabricante
• http://securityfocus.com/archive/1/427990/100/0/threaded · Aviso do Fabricante
• http://secunia.com/advisories/18407 · Aviso do Fabricante
• http://debian.org/security/2005/dsa-780 · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2005_19_sr.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-2097 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDKSA-2005:138 · Aviso do Fabricante
• http://secunia.com/advisories/21339 · Nota
• http://redhat.com/support/errata/RHSA-2005-706.html · Aviso do Fabricante