ID CVE-2007-3387
Summary Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
References
Vulnerable Configurations
  • cpe:2.3:o:redhat:enterprise_linux:4.0:-:as
    cpe:2.3:o:redhat:enterprise_linux:4.0:-:as
  • cpe:2.3:o:redhat:enterprise_linux:4.0:-:es
    cpe:2.3:o:redhat:enterprise_linux:4.0:-:es
  • cpe:2.3:o:redhat:enterprise_linux:4.0:-:ws
    cpe:2.3:o:redhat:enterprise_linux:4.0:-:ws
  • Red Hat Desktop 4.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:4.0
  • cpe:2.3:a:easy_software_products:cups
    cpe:2.3:a:easy_software_products:cups
  • cpe:2.3:a:gnome:gpdf:2.8.1
    cpe:2.3:a:gnome:gpdf:2.8.1
  • cpe:2.3:a:kde:kdegraphics
    cpe:2.3:a:kde:kdegraphics
  • cpe:2.3:a:kde:kpdf
    cpe:2.3:a:kde:kpdf
  • cpe:2.3:a:pdfedit:pdfedit
    cpe:2.3:a:pdfedit:pdfedit
  • cpe:2.3:a:poppler:poppler:0.5.91
    cpe:2.3:a:poppler:poppler:0.5.91
  • cpe:2.3:a:xpdf:xpdf:3.02
    cpe:2.3:a:xpdf:xpdf:3.02
CVSS
Base: 6.8 (as of 31-07-2007 - 17:31)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2007-316-01.NASL
    description New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current. New poppler packages are available for Slackware 12.0 and -current. New koffice packages are available for Slackware 11.0, 12.0, and -current. New kdegraphics packages are available for Slackware 10.2, 11.0, 12.0, and -current. These updated packages address similar bugs which could be used to crash applications linked with poppler or that use code from xpdf through the use of a malformed PDF document. It is possible that a maliciously crafted document could cause code to be executed in the context of the user running the application processing the PDF. These advisories and CVE entries cover the bugs: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.kde.org/info/security/advisory-20071107-1.txt
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 28149
    published 2007-11-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28149
    title Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 9.1 / current : xpdf/poppler/koffice/kdegraphics (SSA:2007-316-01)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200709-17.NASL
    description The remote host is affected by the vulnerability described in GLSA-200709-17 (teTeX: Multiple buffer overflows) Mark Richters discovered a buffer overflow in the open_sty() function in file mkind.c. Other vulnerabilities have also been discovered in the same file but might not be exploitable (CVE-2007-0650). Tetex also includes vulnerable code from GD library (GLSA 200708-05), and from Xpdf (CVE-2007-3387). Impact : A remote attacker could entice a user to process a specially crafted PNG, GIF or PDF file, or to execute 'makeindex' on an overly long filename. In both cases, this could lead to the remote execution of arbitrary code with the privileges of the user running the application. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 26215
    published 2007-10-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=26215
    title GLSA-200709-17 : teTeX: Multiple buffer overflows
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-160.NASL
    description Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause pdftohtml to crash and possibly execute arbitrary code open a user opening the file. This update provides packages which are patched to prevent these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 25892
    published 2007-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25892
    title Mandrake Linux Security Advisory : pdftohtml (MDKSA-2007:160)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1357.NASL
    description It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened. koffice includes a copy of the xpdf code and required an update as well. The oldstable distribution (sarge) will be fixed later.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25937
    published 2007-08-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25937
    title Debian DSA-1357-1 : koffice - integer overflow
  • NASL family SuSE Local Security Checks
    NASL id SUSE_PDFTOHTML-3989.NASL
    description A buffer overflow in the xpdf code contained in pdftohtml could be exploited by attackers to potentially execute arbitrary code (CVE-2007-3387).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27384
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27384
    title openSUSE 10 Security Update : pdftohtml (pdftohtml-3989)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0735.NASL
    description Updated xpdf packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of Xpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25813
    published 2007-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25813
    title CentOS 3 / 4 : xpdf (CESA-2007:0735)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0735.NASL
    description Updated xpdf packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of Xpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25819
    published 2007-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25819
    title RHEL 2.1 / 3 / 4 : xpdf (RHSA-2007:0735)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1347.NASL
    description It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25855
    published 2007-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25855
    title Debian DSA-1347-1 : xpdf - integer overflow
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0731.NASL
    description Updated tetex packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input and creates a typesetter-independent .dvi (DeVice Independent) file as output. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of TeTeX should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25832
    published 2007-08-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25832
    title CentOS 3 / 4 / 5 : tetex (CESA-2007:0731)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0732.NASL
    description Updated poppler packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a PDF rendering library, used by applications such as evince. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause an application linked with poppler to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of poppler should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 43649
    published 2010-01-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=43649
    title CentOS 5 : poppler (CESA-2007:0732)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1355.NASL
    description It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened. kpdf includes a copy of the xpdf code and required an update as well.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25936
    published 2007-08-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25936
    title Debian DSA-1355-1 : kdegraphics - integer overflow
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0730.NASL
    description Updated kdegraphics packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. gpdf is a GNOME based viewer for Portable Document Format (PDF) files. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause gpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of gpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 36643
    published 2009-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=36643
    title CentOS 4 : gpdf (CESA-2007:0730)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KDEGRAPHICS3-PDF-3968.NASL
    description A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29480
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29480
    title SuSE 10 Security Update : kdegraphics3-pdf (ZYPP Patch Number 3968)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_XPDF-3969.NASL
    description A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29608
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29608
    title SuSE 10 Security Update : xpdf (ZYPP Patch Number 3969)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0730.NASL
    description Updated kdegraphics packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. gpdf is a GNOME based viewer for Portable Document Format (PDF) files. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause gpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of gpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25817
    published 2007-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25817
    title RHEL 4 : gpdf (RHSA-2007:0730)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-1547.NASL
    description - Fri Aug 10 2007 Jindrich Novy 3.0-40.1 - backport upstream fix for xpdf integer overflow CVE-2007-3387 (#251514) - don't mess up file contexts while running texhash (#235032) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-21
    plugin id 27721
    published 2007-11-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27721
    title Fedora 7 : tetex-3.0-40.1.fc7 (2007-1547)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-496-2.NASL
    description USN-496-1 fixed a vulnerability in koffice. This update provides the corresponding updates for poppler, the library used for PDF handling in Gnome. Derek Noonburg discovered an integer overflow in the Xpdf function StreamPredictor::StreamPredictor(). By importing a specially crafted PDF file into KWord, this could be exploited to run arbitrary code with the user's privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 28099
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28099
    title Ubuntu 6.06 LTS / 6.10 / 7.04 : poppler vulnerability (USN-496-2)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_POPPLER-3991.NASL
    description A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code (CVE-2007-3387).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27399
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27399
    title openSUSE 10 Security Update : poppler (poppler-3991)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0732.NASL
    description Updated poppler packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a PDF rendering library, used by applications such as evince. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause an application linked with poppler to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of poppler should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25818
    published 2007-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25818
    title RHEL 5 : poppler (RHSA-2007:0732)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_0E43A14D3F3F11DCA79A0016179B2DD5.NASL
    description The KDE Team reports : kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains a vulnerability that can cause a stack based buffer overflow via a PDF file that exploits an integer overflow in StreamPredictor::StreamPredictor(). Remotely supplied pdf files can be used to disrupt the kpdf viewer on the client machine and possibly execute arbitrary code.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 25827
    published 2007-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25827
    title FreeBSD : xpdf -- stack based buffer overflow (0e43a14d-3f3f-11dc-a79a-0016179b2dd5)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1348.NASL
    description It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened. poppler includes a copy of the xpdf code and required an update as well. The oldstable distribution (sarge) doesn't include poppler.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25856
    published 2007-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25856
    title Debian DSA-1348-1 : poppler - integer overflow
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0730.NASL
    description From Red Hat Security Advisory 2007:0730 : Updated kdegraphics packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. gpdf is a GNOME based viewer for Portable Document Format (PDF) files. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause gpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of gpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67550
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67550
    title Oracle Linux 4 : gpdf (ELSA-2007-0730)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-1594.NASL
    description This is an update to address a vulnerability in kpdf, one that can cause a stack based buffer overflow. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-21
    plugin id 27723
    published 2007-11-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27723
    title Fedora 7 : kdegraphics-3.5.7-2.fc7 (2007-1594)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200709-12.NASL
    description The remote host is affected by the vulnerability described in GLSA-200709-12 (Poppler: Two buffer overflow vulnerabilities) Poppler and Xpdf are vulnerable to an integer overflow in the StreamPredictor::StreamPredictor function, and a stack overflow in the StreamPredictor::getNextLine function. The original vulnerability was discovered by Maurycy Prodeus. Note: Gentoo's version of Xpdf is patched to use the Poppler library, so the update to Poppler will also fix Xpdf. Impact : By enticing a user to view a specially crafted program with a Poppler-based PDF viewer such as Gentoo's Xpdf, Epdfview, or Evince, a remote attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-08-10
    plugin id 26102
    published 2007-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=26102
    title GLSA-200709-12 : Poppler: Two buffer overflow vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070730_POPPLER_ON_SL5_X.NASL
    description Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause an application linked with poppler to crash or potentially execute arbitrary code when opened. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60235
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60235
    title Scientific Linux Security Update : poppler on SL5.x i386/x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0729.NASL
    description Updated kdegraphics packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a PDF file viewer. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of kdegraphics should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25816
    published 2007-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25816
    title RHEL 4 / 5 : kdegraphics (RHSA-2007:0729)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-164.NASL
    description Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause tetex to crash and possibly execute arbitrary code open a user opening the file. In addition, tetex contains an embedded copy of the GD library which suffers from a number of bugs which potentially lead to denial of service and possibly other issues. Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472) The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473) Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact. (CVE-2007-3474) The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475) Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault. (CVE-2007-3476) The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477) Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support. (CVE-2007-3478) Updated packages have been patched to prevent these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 25896
    published 2007-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25896
    title Mandrake Linux Security Advisory : tetex (MDKSA-2007:164)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-161.NASL
    description Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause poppler to crash and possibly execute arbitrary code open a user opening the file. This update provides packages which are patched to prevent these issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 25893
    published 2007-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25893
    title Mandrake Linux Security Advisory : poppler (MDKSA-2007:161)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-165.NASL
    description Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause cups to crash and possibly execute arbitrary code open a user opening the file. This update provides packages which are patched to prevent these issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 25923
    published 2007-08-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25923
    title Mandrake Linux Security Advisory : cups (MDKSA-2007:165)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0731.NASL
    description Updated tetex packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input and creates a typesetter-independent .dvi (DeVice Independent) file as output. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of TeTeX should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25829
    published 2007-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25829
    title RHEL 2.1 / 3 / 4 / 5 : tetex (RHSA-2007:0731)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CUPS-4044.NASL
    description A buffer overflow in the xpdf code contained in cups could be exploited by attackers to potentially execute arbitrary code (CVE-2007-3387).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27194
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27194
    title openSUSE 10 Security Update : cups (cups-4044)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0720.NASL
    description From Red Hat Security Advisory 2007:0720 : Updated CUPS packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. Maurycy Prodeus discovered an integer overflow flaw in the way CUPS processes PDF files. An attacker could create a malicious PDF file that could potentially execute arbitrary code when printed. (CVE-2007-3387) All users of CUPS should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67544
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67544
    title Oracle Linux 3 / 4 / 5 : cups (ELSA-2007-0720)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2007-222-02.NASL
    description A new poppler package is available for Slackware 12.0 to fix an integer overflow.
    last seen 2019-02-21
    modified 2013-06-01
    plugin id 25845
    published 2007-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25845
    title Slackware 12.0 : poppler (SSA:2007-222-02)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1350.NASL
    description It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened. tetex-bin includes a copy of the xpdf code and required an update as well.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 25858
    published 2007-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25858
    title Debian DSA-1350-1 : tetex-bin - integer overflow
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070730_KDEGRAPHICS_ON_SL5_X.NASL
    description Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60234
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60234
    title Scientific Linux Security Update : kdegraphics on SL5.x, SL4.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0735.NASL
    description From Red Hat Security Advisory 2007:0735 : Updated xpdf packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of Xpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67553
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67553
    title Oracle Linux 3 / 4 : xpdf (ELSA-2007-0735)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070730_XPDF_ON_SL4_X.NASL
    description Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60236
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60236
    title Scientific Linux Security Update : xpdf on SL4.x, SL3.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0729.NASL
    description From Red Hat Security Advisory 2007:0729 : Updated kdegraphics packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a PDF file viewer. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of kdegraphics should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67549
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67549
    title Oracle Linux 4 : kdegraphics (ELSA-2007-0729)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1352.NASL
    description It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened. pdfkit.framework includes a copy of the xpdf code and required an update as well.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 25860
    published 2007-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25860
    title Debian DSA-1352-1 : pdfkit.framework - integer overflow
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-162.NASL
    description Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause kpdf to crash and possibly execute arbitrary code open a user opening the file. This update provides packages which are patched to prevent these issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 25894
    published 2007-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25894
    title Mandrake Linux Security Advisory : kdegraphics (MDKSA-2007:162)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_KDEGRAPHICS3-PDF-3972.NASL
    description A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-3387).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27288
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27288
    title openSUSE 10 Security Update : kdegraphics3-pdf (kdegraphics3-pdf-3972)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070730_GPDF_ON_SL4_X.NASL
    description Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause gpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60233
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60233
    title Scientific Linux Security Update : gpdf on SL4.x i386/x86_64
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0720.NASL
    description Updated CUPS packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. Maurycy Prodeus discovered an integer overflow flaw in the way CUPS processes PDF files. An attacker could create a malicious PDF file that could potentially execute arbitrary code when printed. (CVE-2007-3387) All users of CUPS should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 25812
    published 2007-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25812
    title CentOS 3 / 4 / 5 : cups (CESA-2007:0720)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200710-20.NASL
    description The remote host is affected by the vulnerability described in GLSA-200710-20 (PDFKit, ImageKits: Buffer overflow) Maurycy Prodeus discovered an integer overflow vulnerability possibly leading to a stack-based buffer overflow in the XPDF code which PDFKit is based on. ImageKits also contains a copy of PDFKit. Impact : By enticing a user to view a specially crafted PDF file with a viewer based on ImageKits or PDFKit such as Gentoo's ViewPDF, a remote attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-11-14
    plugin id 27518
    published 2007-10-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27518
    title GLSA-200710-20 : PDFKit, ImageKits: Buffer overflow
  • NASL family SuSE Local Security Checks
    NASL id SUSE_POPPLER-3992.NASL
    description A buffer overflow in the xpdf code contained in poppler could be exploited by attackers to potentially execute arbitrary code. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29554
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29554
    title SuSE 10 Security Update : poppler,poppler-devel (ZYPP Patch Number 3992)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-163.NASL
    description Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause koffice to crash and possibly execute arbitrary code open a user opening the file. This update provides packages which are patched to prevent these issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 25895
    published 2007-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25895
    title Mandrake Linux Security Advisory : koffice (MDKSA-2007:163)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2007-0720.NASL
    description Updated CUPS packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. Maurycy Prodeus discovered an integer overflow flaw in the way CUPS processes PDF files. An attacker could create a malicious PDF file that could potentially execute arbitrary code when printed. (CVE-2007-3387) All users of CUPS should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-16
    plugin id 25815
    published 2007-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25815
    title RHEL 3 / 4 / 5 : cups (RHSA-2007:0720)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_CUPS-4043.NASL
    description A buffer overflow in the xpdf code contained in cups could be exploited by attackers to potentially execute arbitrary code. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 29412
    published 2007-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=29412
    title SuSE 10 Security Update : cups (ZYPP Patch Number 4043)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2007-0729.NASL
    description Updated kdegraphics packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a PDF file viewer. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of kdegraphics should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 37749
    published 2009-04-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=37749
    title CentOS 4 / 5 : kdegraphics (CESA-2007:0729)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070801_TETEX_ON_SL5_X.NASL
    description Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60238
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60238
    title Scientific Linux Security Update : tetex on SL5.x, SL4.x, SL3.x i386/x86_64
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-1541.NASL
    description This update fixes a security problem concerning PDF handling. It also fixes printing speed with USB printers, and includes a fix for the LSPP support. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-21
    plugin id 27720
    published 2007-11-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27720
    title Fedora 7 : cups-1.2.12-4.fc7 (2007-1541)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_XPDF-3974.NASL
    description A buffer overflow in xpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-3387).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27498
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27498
    title openSUSE 10 Security Update : xpdf (xpdf-3974)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20070730_CUPS_ON_SL5_X.NASL
    description Maurycy Prodeus discovered an integer overflow flaw in the way CUPS processes PDF files. An attacker could create a malicious PDF file that could potentially execute arbitrary code when printed. (CVE-2007-3387)
    last seen 2019-02-21
    modified 2019-01-07
    plugin id 60232
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60232
    title Scientific Linux Security Update : cups on SL5.x, SL4.x, SL3.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0732.NASL
    description From Red Hat Security Advisory 2007:0732 : Updated poppler packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a PDF rendering library, used by applications such as evince. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause an application linked with poppler to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of poppler should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67552
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67552
    title Oracle Linux 5 : poppler (ELSA-2007-0732)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_LIBEXTRACTOR-4041.NASL
    description A buffer overflow in the libextractor code contained in kpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-3387).
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 27323
    published 2007-10-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27323
    title openSUSE 10 Security Update : libextractor (libextractor-4041)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-496-1.NASL
    description Derek Noonburg discovered an integer overflow in the Xpdf function StreamPredictor::StreamPredictor(). By importing a specially crafted PDF file into KWord, this could be exploited to run arbitrary code with the user's privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 28098
    published 2007-11-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28098
    title Ubuntu 6.06 LTS / 6.10 / 7.04 : koffice vulnerability (USN-496-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2007-0731.NASL
    description From Red Hat Security Advisory 2007:0731 : Updated tetex packages that fix a security issue in PDF handling are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input and creates a typesetter-independent .dvi (DeVice Independent) file as output. Maurycy Prodeus discovered an integer overflow flaw in the processing of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened. (CVE-2007-3387) All users of TeTeX should upgrade to these updated packages, which contain a backported patch to resolve this issue.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 67551
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=67551
    title Oracle Linux 3 / 4 / 5 : tetex (ELSA-2007-0731)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2007-1614.NASL
    description This is an update to address a stack-based buffer overflow vulnerability in kword's pdf filter. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-21
    plugin id 27724
    published 2007-11-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=27724
    title Fedora 7 : koffice-1.6.3-9.fc7 (2007-1614)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-200710-08.NASL
    description The remote host is affected by the vulnerability described in GLSA-200710-08 (KOffice, KWord, KPDF, KDE Graphics Libraries: Stack-based buffer overflow) KPDF includes code from xpdf that is vulnerable to an integer overflow in the StreamPredictor::StreamPredictor() function. Impact : A remote attacker could entice a user to open a specially crafted PDF file in KWord or KPDF that would exploit the integer overflow to cause a stack-based buffer overflow in the StreamPredictor::getNextLine() function, possibly resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-08-10
    plugin id 26979
    published 2007-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=26979
    title GLSA-200710-08 : KOffice, KWord, KPDF, KDE Graphics Libraries: Stack-based buffer overflow
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2007-222-05.NASL
    description New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0 to fix an integer overflow.
    last seen 2019-02-21
    modified 2018-06-27
    plugin id 25848
    published 2007-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25848
    title Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 9.1 : xpdf (SSA:2007-222-05)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2007-158.NASL
    description Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause xpdf to crash and possibly execute arbitrary code open a user opening the file. This update provides packages which are patched to prevent these issues.
    last seen 2019-02-21
    modified 2018-12-05
    plugin id 25891
    published 2007-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25891
    title Mandrake Linux Security Advisory : xpdf (MDKSA-2007:158)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1354.NASL
    description It was discovered that an integer overflow in xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened. gpdf includes a copy of the xpdf code and requires an update as well.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 25887
    published 2007-08-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25887
    title Debian DSA-1354-1 : gpdf - integer overflow
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-1349.NASL
    description It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened. libextractor includes a copy of the xpdf code and required an update as well.
    last seen 2019-02-21
    modified 2018-08-09
    plugin id 25857
    published 2007-08-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=25857
    title Debian DSA-1349-1 : libextractor - integer overflow
oval via4
accepted 2013-04-29T04:11:52.378-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
  • comment The operating system installed on the system is Red Hat Enterprise Linux 5
    oval oval:org.mitre.oval:def:11414
  • comment The operating system installed on the system is CentOS Linux 5.x
    oval oval:org.mitre.oval:def:15802
  • comment Oracle Linux 5.x
    oval oval:org.mitre.oval:def:15459
description Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
family unix
id oval:org.mitre.oval:def:11149
status accepted
submitted 2010-07-09T03:56:16-04:00
title Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.
version 24
redhat via4
advisories
  • bugzilla
    id 248194
    title CVE-2007-3387 xpdf integer overflow
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 3 is installed
        oval oval:com.redhat.rhba:tst:20070026001
      • OR
        • AND
          • comment cups is earlier than 1:1.1.17-13.3.45
            oval oval:com.redhat.rhsa:tst:20070720002
          • comment cups is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070123003
        • AND
          • comment cups-devel is earlier than 1:1.1.17-13.3.45
            oval oval:com.redhat.rhsa:tst:20070720004
          • comment cups-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070123007
        • AND
          • comment cups-libs is earlier than 1:1.1.17-13.3.45
            oval oval:com.redhat.rhsa:tst:20070720006
          • comment cups-libs is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070123005
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304001
      • OR
        • AND
          • comment cups is earlier than 1:1.1.22-0.rc1.9.20.2
            oval oval:com.redhat.rhsa:tst:20070720009
          • comment cups is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070123003
        • AND
          • comment cups-devel is earlier than 1:1.1.22-0.rc1.9.20.2
            oval oval:com.redhat.rhsa:tst:20070720010
          • comment cups-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070123007
        • AND
          • comment cups-libs is earlier than 1:1.1.22-0.rc1.9.20.2
            oval oval:com.redhat.rhsa:tst:20070720011
          • comment cups-libs is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070123005
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331001
      • OR
        • AND
          • comment cups is earlier than 1:1.2.4-11.5.3.el5
            oval oval:com.redhat.rhsa:tst:20070720013
          • comment cups is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070123014
        • AND
          • comment cups-devel is earlier than 1:1.2.4-11.5.3.el5
            oval oval:com.redhat.rhsa:tst:20070720017
          • comment cups-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070123020
        • AND
          • comment cups-libs is earlier than 1:1.2.4-11.5.3.el5
            oval oval:com.redhat.rhsa:tst:20070720019
          • comment cups-libs is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070123018
        • AND
          • comment cups-lpd is earlier than 1:1.2.4-11.5.3.el5
            oval oval:com.redhat.rhsa:tst:20070720015
          • comment cups-lpd is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070123016
    rhsa
    id RHSA-2007:0720
    released 2007-07-30
    severity Important
    title RHSA-2007:0720: cups security update (Important)
  • bugzilla
    id 248194
    title CVE-2007-3387 xpdf integer overflow
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304001
      • OR
        • AND
          • comment kdegraphics is earlier than 7:3.3.1-4.RHEL4
            oval oval:com.redhat.rhsa:tst:20070729002
          • comment kdegraphics is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070729003
        • AND
          • comment kdegraphics-devel is earlier than 7:3.3.1-4.RHEL4
            oval oval:com.redhat.rhsa:tst:20070729004
          • comment kdegraphics-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070729005
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331001
      • OR
        • AND
          • comment kdegraphics is earlier than 7:3.5.4-2.el5
            oval oval:com.redhat.rhsa:tst:20070729007
          • comment kdegraphics is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070729008
        • AND
          • comment kdegraphics-devel is earlier than 7:3.5.4-2.el5
            oval oval:com.redhat.rhsa:tst:20070729009
          • comment kdegraphics-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070729010
    rhsa
    id RHSA-2007:0729
    released 2007-07-30
    severity Important
    title RHSA-2007:0729: kdegraphics security update (Important)
  • bugzilla
    id 248194
    title CVE-2007-3387 xpdf integer overflow
    oval
    AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304001
    • comment gpdf is earlier than 0:2.8.2-7.7
      oval oval:com.redhat.rhsa:tst:20070730002
    • comment gpdf is signed with Red Hat master key
      oval oval:com.redhat.rhsa:tst:20070730003
    rhsa
    id RHSA-2007:0730
    released 2007-07-30
    severity Important
    title RHSA-2007:0730: gpdf security update (Important)
  • bugzilla
    id 248194
    title CVE-2007-3387 xpdf integer overflow
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 3 is installed
        oval oval:com.redhat.rhba:tst:20070026001
      • OR
        • AND
          • comment tetex is earlier than 0:1.0.7-67.10
            oval oval:com.redhat.rhsa:tst:20070731002
          • comment tetex is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731003
        • AND
          • comment tetex-afm is earlier than 0:1.0.7-67.10
            oval oval:com.redhat.rhsa:tst:20070731010
          • comment tetex-afm is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731011
        • AND
          • comment tetex-dvips is earlier than 0:1.0.7-67.10
            oval oval:com.redhat.rhsa:tst:20070731006
          • comment tetex-dvips is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731007
        • AND
          • comment tetex-fonts is earlier than 0:1.0.7-67.10
            oval oval:com.redhat.rhsa:tst:20070731012
          • comment tetex-fonts is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731013
        • AND
          • comment tetex-latex is earlier than 0:1.0.7-67.10
            oval oval:com.redhat.rhsa:tst:20070731004
          • comment tetex-latex is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731005
        • AND
          • comment tetex-xdvi is earlier than 0:1.0.7-67.10
            oval oval:com.redhat.rhsa:tst:20070731008
          • comment tetex-xdvi is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731009
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304001
      • OR
        • AND
          • comment tetex is earlier than 0:2.0.2-22.0.1.EL4.8
            oval oval:com.redhat.rhsa:tst:20070731015
          • comment tetex is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731003
        • AND
          • comment tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.8
            oval oval:com.redhat.rhsa:tst:20070731020
          • comment tetex-afm is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731011
        • AND
          • comment tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.8
            oval oval:com.redhat.rhsa:tst:20070731017
          • comment tetex-doc is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731018
        • AND
          • comment tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.8
            oval oval:com.redhat.rhsa:tst:20070731021
          • comment tetex-dvips is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731007
        • AND
          • comment tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.8
            oval oval:com.redhat.rhsa:tst:20070731016
          • comment tetex-fonts is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731013
        • AND
          • comment tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.8
            oval oval:com.redhat.rhsa:tst:20070731022
          • comment tetex-latex is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731005
        • AND
          • comment tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.8
            oval oval:com.redhat.rhsa:tst:20070731019
          • comment tetex-xdvi is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070731009
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331001
      • OR
        • AND
          • comment tetex is earlier than 0:3.0-33.1.el5
            oval oval:com.redhat.rhsa:tst:20070731024
          • comment tetex is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070731025
        • AND
          • comment tetex-afm is earlier than 0:3.0-33.1.el5
            oval oval:com.redhat.rhsa:tst:20070731036
          • comment tetex-afm is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070731037
        • AND
          • comment tetex-doc is earlier than 0:3.0-33.1.el5
            oval oval:com.redhat.rhsa:tst:20070731030
          • comment tetex-doc is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070731031
        • AND
          • comment tetex-dvips is earlier than 0:3.0-33.1.el5
            oval oval:com.redhat.rhsa:tst:20070731032
          • comment tetex-dvips is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070731033
        • AND
          • comment tetex-fonts is earlier than 0:3.0-33.1.el5
            oval oval:com.redhat.rhsa:tst:20070731034
          • comment tetex-fonts is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070731035
        • AND
          • comment tetex-latex is earlier than 0:3.0-33.1.el5
            oval oval:com.redhat.rhsa:tst:20070731026
          • comment tetex-latex is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070731027
        • AND
          • comment tetex-xdvi is earlier than 0:3.0-33.1.el5
            oval oval:com.redhat.rhsa:tst:20070731028
          • comment tetex-xdvi is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070731029
    rhsa
    id RHSA-2007:0731
    released 2007-08-01
    severity Important
    title RHSA-2007:0731: tetex security update (Important)
  • bugzilla
    id 248194
    title CVE-2007-3387 xpdf integer overflow
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment poppler is earlier than 0:0.5.4-4.1.el5
          oval oval:com.redhat.rhsa:tst:20070732002
        • comment poppler is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070732003
      • AND
        • comment poppler-devel is earlier than 0:0.5.4-4.1.el5
          oval oval:com.redhat.rhsa:tst:20070732004
        • comment poppler-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070732005
      • AND
        • comment poppler-utils is earlier than 0:0.5.4-4.1.el5
          oval oval:com.redhat.rhsa:tst:20070732006
        • comment poppler-utils is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20070732007
    rhsa
    id RHSA-2007:0732
    released 2007-07-30
    severity Important
    title RHSA-2007:0732: poppler security update (Important)
  • bugzilla
    id 248194
    title CVE-2007-3387 xpdf integer overflow
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 3 is installed
        oval oval:com.redhat.rhba:tst:20070026001
      • comment xpdf is earlier than 1:2.02-10.RHEL3
        oval oval:com.redhat.rhsa:tst:20070735002
      • comment xpdf is signed with Red Hat master key
        oval oval:com.redhat.rhsa:tst:20070735003
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhba:tst:20070304001
      • comment xpdf is earlier than 1:3.00-12.RHEL4
        oval oval:com.redhat.rhsa:tst:20070735005
      • comment xpdf is signed with Red Hat master key
        oval oval:com.redhat.rhsa:tst:20070735003
    rhsa
    id RHSA-2007:0735
    released 2007-07-30
    severity Important
    title RHSA-2007:0735: xpdf security update (Important)
rpms
  • cups-1:1.1.17-13.3.45
  • cups-devel-1:1.1.17-13.3.45
  • cups-libs-1:1.1.17-13.3.45
  • cups-1:1.1.22-0.rc1.9.20.2
  • cups-devel-1:1.1.22-0.rc1.9.20.2
  • cups-libs-1:1.1.22-0.rc1.9.20.2
  • cups-1:1.2.4-11.5.3.el5
  • cups-devel-1:1.2.4-11.5.3.el5
  • cups-libs-1:1.2.4-11.5.3.el5
  • cups-lpd-1:1.2.4-11.5.3.el5
  • kdegraphics-7:3.3.1-4.RHEL4
  • kdegraphics-devel-7:3.3.1-4.RHEL4
  • kdegraphics-7:3.5.4-2.el5
  • kdegraphics-devel-7:3.5.4-2.el5
  • gpdf-0:2.8.2-7.7
  • tetex-0:1.0.7-67.10
  • tetex-afm-0:1.0.7-67.10
  • tetex-dvips-0:1.0.7-67.10
  • tetex-fonts-0:1.0.7-67.10
  • tetex-latex-0:1.0.7-67.10
  • tetex-xdvi-0:1.0.7-67.10
  • tetex-0:2.0.2-22.0.1.EL4.8
  • tetex-afm-0:2.0.2-22.0.1.EL4.8
  • tetex-doc-0:2.0.2-22.0.1.EL4.8
  • tetex-dvips-0:2.0.2-22.0.1.EL4.8
  • tetex-fonts-0:2.0.2-22.0.1.EL4.8
  • tetex-latex-0:2.0.2-22.0.1.EL4.8
  • tetex-xdvi-0:2.0.2-22.0.1.EL4.8
  • tetex-0:3.0-33.1.el5
  • tetex-afm-0:3.0-33.1.el5
  • tetex-doc-0:3.0-33.1.el5
  • tetex-dvips-0:3.0-33.1.el5
  • tetex-fonts-0:3.0-33.1.el5
  • tetex-latex-0:3.0-33.1.el5
  • tetex-xdvi-0:3.0-33.1.el5
  • poppler-0:0.5.4-4.1.el5
  • poppler-devel-0:0.5.4-4.1.el5
  • poppler-utils-0:0.5.4-4.1.el5
  • xpdf-1:2.02-10.RHEL3
  • xpdf-1:3.00-12.RHEL4
refmap via4
bid 25124
bugtraq
  • 20070814 FLEA-2007-0044-1 tetex tetex-dvips tetex-fonts
  • 20070814 FLEA-2007-0045-1 poppler
  • 20070816 FLEA-2007-0046-1 cups
confirm
debian
  • DSA-1347
  • DSA-1348
  • DSA-1349
  • DSA-1350
  • DSA-1352
  • DSA-1354
  • DSA-1355
  • DSA-1357
gentoo
  • GLSA-200709-12
  • GLSA-200709-17
  • GLSA-200710-08
  • GLSA-200710-20
  • GLSA-200711-34
  • GLSA-200805-13
mandriva
  • MDKSA-2007:158
  • MDKSA-2007:159
  • MDKSA-2007:160
  • MDKSA-2007:161
  • MDKSA-2007:162
  • MDKSA-2007:163
  • MDKSA-2007:164
  • MDKSA-2007:165
misc
osvdb 40127
sectrack 1018473
secunia
  • 26188
  • 26251
  • 26254
  • 26255
  • 26257
  • 26278
  • 26281
  • 26283
  • 26292
  • 26293
  • 26297
  • 26307
  • 26318
  • 26325
  • 26342
  • 26343
  • 26358
  • 26365
  • 26370
  • 26395
  • 26403
  • 26405
  • 26407
  • 26410
  • 26413
  • 26425
  • 26432
  • 26436
  • 26467
  • 26468
  • 26470
  • 26514
  • 26607
  • 26627
  • 26862
  • 26982
  • 27156
  • 27281
  • 27308
  • 27637
  • 30168
sgi 20070801-01-P
slackware
  • SSA:2007-222-05
  • SSA:2007-316-01
suse
  • SUSE-SR:2007:015
  • SUSE-SR:2007:016
ubuntu
  • USN-496-1
  • USN-496-2
vupen
  • ADV-2007-2704
  • ADV-2007-2705
Last major update 07-03-2011 - 00:00
Published 30-07-2007 - 19:17
Last modified 16-10-2018 - 12:48
Back to Top