PT-2005-1039 · Gnu+7 · Libextractor+9

Chris Evans · Published 2005-12-06 · Updated 2018-10-19 · CVE-2005-3626

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions kdegraphics versions prior to 3.4.3-r3 Xpdf (affected versions not specified) pdftohtml (affected versions not specified)

Description The issue affects various products, including gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, due to a problem in Xpdf. It allows attackers to cause a denial of service via a crafted FlateDecode stream that triggers a null dereference. Exploitation of the vulnerabilities can lead to disruption of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For kdegraphics versions prior to 3.4.3-r3, update to version 3.4.3-r3 or later. For Xpdf, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For pdftohtml, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Weakness Enumeration

CWE-399

CWE-119

Related Identifiers

BDU:2015-03279

BDU:2015-09484

CVE-2005-3626

DSA-931-1

DSA-932-1

DSA-936-1

DSA-937-1

DSA-938-1

DSA-940-1

DSA-950-1

DSA-961-1

DSA-962-1

DTSA-28-1

RHSA-2005:840

RHSA-2005:868

RHSA-2005_840

RHSA-2005_868

RHSA-2006:0160

RHSA-2006:0163

RHSA-2006:0177

RHSA-2006_0160

RHSA-2006_0163

RHSA-2006_0177

Affected Products

Cups

Red Hat

Xpdf

Gpdf

Kdegraphics

Kpdf

Libextractor

Pdftohtml

Poppler

Tetex

References · 123

• 🔥 http://scary.beasts.org/security/CESA-2005-003.txt · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:012 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3626 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:010 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627 · Security Note
• http://secunia.com/advisories/18385 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09484 · Security Note
• http://secunia.com/advisories/18375 · Vendor Advisory
• http://redhat.com/archives/fedora-announce-list/2006-January/msg00030.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03279 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:005 · Vendor Advisory
• http://secunia.com/advisories/18407 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626 · Security Note
• http://secunia.com/advisories/18303 · Vendor Advisory