ID CVE-2005-3627
Summary Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.
References
Vulnerable Configurations
  • cpe:2.3:a:xpdf:xpdf:*:*:*:*:*:*:*:*
    cpe:2.3:a:xpdf:xpdf:*:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 19-10-2018 - 15:37)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:03:22.745-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.
family unix
id oval:org.mitre.oval:def:10200
status accepted
submitted 2010-07-09T03:56:16-04:00
title Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.
version 23
redhat via4
advisories
  • bugzilla
    id 176868
    title CVE-2005-3624 Additional xpdf issues (CVE-2005-3625 CVE-2005-3626 CVE-2005-3627)
    oval
    OR
    • AND
      comment Red Hat Enterprise Linux 3 is installed
      oval oval:com.redhat.rhba:tst:20070026001
    • AND
      comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304001
    rhsa
    id RHSA-2006:0163
    released 2006-01-11
    severity Important
    title RHSA-2006:0163: cups security update (Important)
  • bugzilla
    id 176865
    title [RHEL4] CVE-2005-3624 Additional xpdf issues (CVE-2005-3625 CVE-2005-3626 CVE-2005-3627)
    oval
    AND
    comment Red Hat Enterprise Linux 4 is installed
    oval oval:com.redhat.rhba:tst:20070304001
    rhsa
    id RHSA-2006:0177
    released 2006-01-11
    severity Important
    title RHSA-2006:0177: gpdf security update (Important)
  • rhsa
    id RHSA-2006:0160
refmap via4
bid 16143
confirm
debian
  • DSA-931
  • DSA-932
  • DSA-936
  • DSA-937
  • DSA-938
  • DSA-940
  • DSA-950
  • DSA-961
  • DSA-962
fedora
  • FEDORA-2005-025
  • FEDORA-2005-026
  • FLSA-2006:176751
  • FLSA:175404
gentoo
  • GLSA-200601-02
  • GLSA-200601-17
mandrake MDKSA-2006:010
mandriva
  • MDKSA-2006:003
  • MDKSA-2006:004
  • MDKSA-2006:005
  • MDKSA-2006:006
  • MDKSA-2006:008
  • MDKSA-2006:011
  • MDKSA-2006:012
misc http://scary.beasts.org/security/CESA-2005-003.txt
sco SCOSA-2006.15
secunia
  • 18147
  • 18303
  • 18312
  • 18313
  • 18329
  • 18332
  • 18334
  • 18335
  • 18338
  • 18349
  • 18373
  • 18375
  • 18380
  • 18385
  • 18387
  • 18389
  • 18398
  • 18407
  • 18414
  • 18416
  • 18423
  • 18425
  • 18428
  • 18436
  • 18448
  • 18463
  • 18517
  • 18534
  • 18554
  • 18582
  • 18642
  • 18644
  • 18674
  • 18675
  • 18679
  • 18908
  • 18913
  • 19230
  • 19377
  • 25729
sgi
  • 20051201-01-U
  • 20060101-01-U
  • 20060201-01-U
slackware
  • SSA:2006-045-04
  • SSA:2006-045-09
sunalert 102972
suse SUSE-SA:2006:001
trustix 2006-0002
ubuntu USN-236-1
vupen
  • ADV-2006-0047
  • ADV-2007-2280
xf
  • xpdf-readhuffmantables-bo(24024)
  • xpdf-readscaninfo-bo(24025)
statements via4
contributor Mark J Cox
lastmodified 2007-03-14
organization Red Hat
statement Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Last major update 19-10-2018 - 15:37
Published 31-12-2005 - 05:00
Back to Top