CVE-2005-3191
Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE…
Does this matter?
Lower severity and a low EPSS score (4.08%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 4.08% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- xpdf/xpdf
- Source
- cve@mitre.org
References
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt
- ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt
- ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U
- ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
- ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289
- http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html
- http://rhn.redhat.com/errata/RHSA-2005-868.htmlVendor Advisory
- http://secunia.com/advisories/17897Vendor Advisory
- http://secunia.com/advisories/17908Vendor Advisory
- http://secunia.com/advisories/17912Vendor Advisory
- http://secunia.com/advisories/17916Vendor Advisory
- http://secunia.com/advisories/17920Vendor Advisory
- http://secunia.com/advisories/17921Vendor Advisory
- http://secunia.com/advisories/17926Vendor Advisory
- http://secunia.com/advisories/17929Vendor Advisory
- http://secunia.com/advisories/17940Vendor Advisory
- http://secunia.com/advisories/17955
- http://secunia.com/advisories/17976Vendor Advisory
- http://secunia.com/advisories/18009Vendor Advisory
- http://secunia.com/advisories/18055Vendor Advisory
- http://secunia.com/advisories/18061Vendor Advisory
- http://secunia.com/advisories/18147
- http://secunia.com/advisories/18189Vendor Advisory
- http://secunia.com/advisories/18191Vendor Advisory
- http://secunia.com/advisories/18192Vendor Advisory
- http://secunia.com/advisories/18303
- http://secunia.com/advisories/18313Vendor Advisory
- http://secunia.com/advisories/18336Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.