CVE-2005-3192
Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 6.14% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- xpdf/xpdf
- Source
- cve@mitre.org
References
- ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patchPatch
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt
- ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt
- ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U
- ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
- ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289
- http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html
- http://rhn.redhat.com/errata/RHSA-2005-868.htmlVendor Advisory
- http://scary.beasts.org/security/CESA-2005-003.txt
- http://secunia.com/advisories/17897/Patch, Vendor Advisory
- http://secunia.com/advisories/17908Vendor Advisory
- http://secunia.com/advisories/17912Vendor Advisory
- http://secunia.com/advisories/17916Vendor Advisory
- http://secunia.com/advisories/17920Vendor Advisory
- http://secunia.com/advisories/17921Vendor Advisory
- http://secunia.com/advisories/17926Vendor Advisory
- http://secunia.com/advisories/17929Vendor Advisory
- http://secunia.com/advisories/17940Vendor Advisory
- http://secunia.com/advisories/17955
- http://secunia.com/advisories/17976Vendor Advisory
- http://secunia.com/advisories/18009Vendor Advisory
- http://secunia.com/advisories/18055Vendor Advisory
- http://secunia.com/advisories/18061Vendor Advisory
- http://secunia.com/advisories/18189Vendor Advisory
- http://secunia.com/advisories/18191Vendor Advisory
- http://secunia.com/advisories/18192Vendor Advisory
- http://secunia.com/advisories/18303
- http://secunia.com/advisories/18313Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.