PT-2005-1034 · Foo+2 · Xpdf+3

Infamous41Md · Published 2005-12-06 · Updated 2018-10-19 · CVE-2005-3191

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics versions prior to 3.4.3-r3 pdftohtml (affected versions not specified) xpdf versions prior to 3.01

Description The issue involves multiple vulnerabilities in the kdegraphics package and the pdftohtml package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Additionally, there are heap-based buffer overflows in the DCTStream::readProgressiveSOF and DCTStream::readBaselineSOF functions in the DCT stream parsing code of xpdf, which can cause a denial of service and possibly allow the execution of arbitrary code via a crafted PDF file.

Recommendations For kdegraphics versions prior to 3.4.3-r3, update to version 3.4.3-r3 or later. For pdftohtml, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For xpdf versions prior to 3.01, update to version 3.01 or later. As a temporary workaround, consider avoiding the use of the DCTStream::readProgressiveSOF and DCTStream::readBaselineSOF functions until a patch is available. Restrict the processing of crafted PDF files to minimize the risk of exploitation.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-03279

BDU:2015-09484

CVE-2005-3191

DSA-931-1

DSA-932-1

DSA-936-1

DSA-937-1

DSA-938-1

DSA-940-1

DSA-950-1

DSA-961-1

DSA-962-1

DSA-979-1

DSA-982-1

DSA-983-1

DSA-984-1

RHSA-2005:840

RHSA-2005:867

RHSA-2005:868

RHSA-2005:878

RHSA-2005_840

RHSA-2005_867

RHSA-2005_868

RHSA-2005_878

RHSA-2006:0160

RHSA-2006_0160

Affected Products

Red Hat

Kdegraphics

Pdftohtml

Xpdf

References · 154

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:010 · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2005-December/msg00036.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627 · Security Note
• http://secunia.com/advisories/18385 · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03279 · Security Note
• http://idefense.com/application/poi/display?id=342&type=vulnerabilities · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:005 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_02_sr.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:011 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2005-868.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624 · Security Note
• http://secunia.com/advisories/17976 · Vendor Advisory