PT-2005-1038 · Foxtail Technology+3 · Xpdf+3

Chris Evans · Published 2005-12-06 · Updated 2018-10-19 · CVE-2005-3625

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics versions prior to 3.4.3-r3 pdftohtml (affected versions not specified) Xpdf (affected versions not specified)

Description The issue affects multiple components, including kdegraphics and pdftohtml, allowing remote exploitation that may lead to confidentiality, integrity, and availability breaches. Specifically, Xpdf is vulnerable to a denial of service (infinite loop) via prematurely ended streams, such as CCITTFaxDecode and DCTDecode streams.

Recommendations For kdegraphics versions prior to 3.4.3-r3, update to version 3.4.3-r3 or later. For pdftohtml, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Xpdf, consider disabling the use of CCITTFaxDecode and DCTDecode streams until a patch is available.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-399

CWE-119

Related Identifiers

BDU:2015-03279

BDU:2015-09484

CVE-2005-3625

DSA-931-1

DSA-932-1

DSA-936-1

DSA-937-1

DSA-938-1

DSA-940-1

DSA-950-1

DSA-961-1

DSA-962-1

DTSA-28-1

RHSA-2005:840

RHSA-2005:868

RHSA-2005_840

RHSA-2005_868

RHSA-2006:0160

RHSA-2006:0163

RHSA-2006:0177

RHSA-2006_0160

RHSA-2006_0163

RHSA-2006_0177

Affected Products

Red Hat

Xpdf

Kdegraphics

Pdftohtml

References · 123

• 🔥 http://scary.beasts.org/security/CESA-2005-003.txt · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:010 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627 · Security Note
• http://secunia.com/advisories/18385 · Vendor Advisory
• http://secunia.com/advisories/18375 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03279 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:005 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626 · Security Note
• http://secunia.com/advisories/18303 · Vendor Advisory
• http://secunia.com/advisories/18674 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:011 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624 · Security Note
• http://trustix.org/errata/2006/0002 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2006-0177.html · Vendor Advisory