PT-2007-7532 · Gnu+4 · Libextractor+11

Publicado 1970-01-01 · Atualizado 2024-06-15 · CVE-2007-5393

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics3-pdf versions (affected versions not specified) tetex-latex-3.0 version 3.0 tetex-xdvi-3.0 version 3.0 tetex-dvips-3.0 version 3.0 tetex-doc-3.0 version 3.0 tetex-3.0 version 3.0 libextractor versions (affected versions not specified) libextractor-devel versions (affected versions not specified) tetex-fonts-3.0 version 3.0 tetex-afm-3.0 version 3.0 Xpdf version 3.02p11

Description The issue involves multiple vulnerabilities in various packages of operating systems, including SUSE Linux Enterprise and Red Hat Enterprise Linux. These vulnerabilities can lead to the disruption of confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely. Specifically, a heap-based buffer overflow in the CCITTFaxStream::lookChar method in Xpdf's Stream.cc allows remote attackers to execute arbitrary code via a crafted PDF file containing a CCITTFaxDecode filter.

Recommendations For kdegraphics3-pdf, update to a version that contains a fix for this issue. For tetex-latex-3.0, tetex-xdvi-3.0, tetex-dvips-3.0, tetex-doc-3.0, tetex-3.0, tetex-fonts-3.0, and tetex-afm-3.0, update to a version that contains a fix for this issue. For libextractor and libextractor-devel, update to a version that contains a fix for this issue. For Xpdf version 3.02p11, consider disabling the CCITTFaxStream::lookChar method until a patch is available. As a temporary workaround, restrict access to vulnerable packages to minimize the risk of exploitation.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2015-04628

BDU:2015-04629

BDU:2015-04630

BDU:2015-06556

BDU:2015-06557

BDU:2015-06558

BDU:2015-06559

BDU:2015-06560

BDU:2015-06561

BDU:2015-06562

CVE-2007-5393

DSA-1408-1

DSA-1480-1

DSA-1509-1

DSA-1537-1

DTSA-85-1

DTSA-86-1

OPENSUSE-SU-2024:10707-1

OPENSUSE-SU-2024:11181-1

RHSA-2007:1021

RHSA-2007:1022

RHSA-2007:1023

RHSA-2007:1024

RHSA-2007:1025

RHSA-2007:1026

RHSA-2007:1027

RHSA-2007:1028

RHSA-2007:1029

RHSA-2007:1030

RHSA-2007:1031

RHSA-2007:1051

RHSA-2007_1021

RHSA-2007_1022

RHSA-2007_1024

RHSA-2007_1025

RHSA-2007_1026

RHSA-2007_1027

RHSA-2007_1029

RHSA-2007_1051

Produtos afetados

Red Hat

Xpdf

Kdegraphics3-Pdf

Libextractor

Libextractor-Devel

Tetex-3.0

Tetex-Afm-3.0

Tetex-Doc-3.0

Tetex-Dvips-3.0

Tetex-Fonts-3.0

Tetex-Latex-3.0

Tetex-Xdvi-3.0

Referências · 157

• https://bdu.fstec.ru/vul/2015-01977 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-04629 · Nota de Segurança
• http://secunia.com/advisories/27632 · Nota
• https://suse.com/security/cve/CVE-2021-25317 · Nota
• http://support.novell.com/techcenter/psdb/da3498f05433976cc548cc4eaf8349c8.html · Nota
• http://vupen.com/english/advisories/2007/3775 · Nota
• http://redhat.com/support/errata/RHSA-2007-1051.html · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200711-34.xml · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2007:227 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-5393 · Nota
• https://access.redhat.com/errata/RHSA-2007:1026 · Nota
• https://suse.com/security/cve/CVE-2007-4352 · Nota
• https://suse.com/security/cve/CVE-2019-8696 · Nota
• http://secunia.com/advisories/27619 · Nota
• http://support.novell.com/techcenter/psdb/1d5fd29802b2ef7e342e733731f1e933.html · Nota