PT-2005-1036 · Foo+2 · Xpdf+3

Infamous41Md · Published 2005-12-06 · Updated 2024-06-15 · CVE-2005-3193

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics versions prior to 3.4.3-r3 pdftohtml (affected versions not specified) xpdf version 3.01 and earlier

Description The issue involves multiple vulnerabilities in the kdegraphics package and the pdftohtml package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. Additionally, a heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code for xpdf can cause a denial of service and possibly allow the execution of arbitrary code via a crafted PDF file.

Recommendations For kdegraphics versions prior to 3.4.3-r3, update to version 3.4.3-r3 or later. For pdftohtml, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For xpdf version 3.01 and earlier, consider disabling the use of the JPXStream::readCodestream function until a patch is available. Restrict the processing of PDF files with large size values to minimize the risk of exploitation.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-03279

BDU:2015-09484

CVE-2005-3193

DSA-931-1

DSA-932-1

DSA-936-1

DSA-937-1

DSA-950-1

DSA-961-1

DSA-979-1

DSA-982-1

DSA-984-1

DTSA-28-1

OPENSUSE-SU-2024:10707-1

RHSA-2005:840

RHSA-2005:867

RHSA-2005:868

RHSA-2005:878

RHSA-2005_840

RHSA-2005_867

RHSA-2005_868

RHSA-2005_878

RHSA-2006:0160

RHSA-2006_0160

Affected Products

Red Hat

Kdegraphics

Pdftohtml

Xpdf

References · 170

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:010 · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2005-December/msg00036.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627 · Security Note
• http://secunia.com/advisories/18385 · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03279 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:005 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2005-3193 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:011 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2005-868.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624 · Security Note
• http://secunia.com/advisories/17976 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-878.html · Vendor Advisory