PT-2007-1589 · Kde · Kpdf

Published 2007-01-09 · Updated 2024-06-15 · CVE-2007-0104

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xpdf versions 3.0.1 patch 2 kpdf in KDE versions prior to 3.5.5 poppler versions prior to 0.5.4

Description The issue allows remote attackers to have an unknown impact, possibly including denial of service, arbitrary code execution, or memory corruption, via a PDF file with a crafted catalog dictionary or a crafted Pages attribute that references an invalid page tree node.

Recommendations For xpdf version 3.0.1 patch 2, update to a version later than 3.0.1 patch 2. For kpdf in KDE versions prior to 3.5.5, update to version 3.5.5 or later. For poppler versions prior to 0.5.4, update to version 0.5.4 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-0104

OPENSUSE-SU-2024:10707-1

OPENSUSE-SU-2024:11181-1

Affected Products

Kpdf

References · 66

• 🔥 http://securityfocus.com/bid/21910 · Exploit
• http://secunia.com/advisories/23815 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:018 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11181-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:020 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-0104 · Vendor Advisory
• http://secunia.com/advisories/23799 · Vendor Advisory
• http://secunia.com/advisories/23839 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:019 · Vendor Advisory
• http://ubuntu.com/usn/usn-410-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-0104 · Vendor Advisory
• http://secunia.com/advisories/23813 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-0104 · Vendor Advisory
• http://secunia.com/advisories/23808 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2007:021 · Vendor Advisory