National Cyber-Alert System

Vulnerability Summary for CVE-2005-3193

Overview

Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: IDEFENSE

Name: 20051205 Multiple Vendor xpdf JPX Stream Reader Heap Overflow Vulnerability

Type: Advisory; Patch Information

Hyperlink:http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities&flashstatus=true

External Source: XF

Name: xpdf-jpx-stream-bo(23441)

Hyperlink:http://xforce.iss.net/xforce/xfdb/23441

External Source: UBUNTU

Name: USN-227-1

Hyperlink:http://www.ubuntulinux.org/usn/usn-227-1

External Source: TRUSTIX

Name: TSLSA-2005-0072

Hyperlink:http://www.trustix.org/errata/2005/0072/

External Source: BID

Name: 15721

Hyperlink:http://www.securityfocus.com/bid/15721

External Source: BUGTRAQ

Name: 20051207 [KDE Security Advisory] multiple buffer overflows in kpdf/koffice

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/418883/100/0/threaded

External Source: REDHAT

Name: RHSA-2005:878

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-878.html

External Source: REDHAT

Name: RHSA-2005:867

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-867.html

External Source: REDHAT

Name: RHSA-2005:840

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-840.html

External Source: FEDORA

Name: FEDORA-2005-1142

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00037.html

External Source: FEDORA

Name: FEDORA-2005-1141

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00036.html

External Source: CONFIRM

Name: http://www.kde.org/info/security/advisory-20051207-2.txt

Hyperlink:http://www.kde.org/info/security/advisory-20051207-2.txt

External Source: CONFIRM

Name: http://www.kde.org/info/security/advisory-20051207-1.txt

Hyperlink:http://www.kde.org/info/security/advisory-20051207-1.txt

External Source: IDEFENSE

Name: 20051205 Multiple Vendor xpdf JPX Stream Reader Heap Overflow Vulnerability

Hyperlink:http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities&flashstatus=true

External Source: GENTOO

Name: GLSA-200601-02

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml

External Source: GENTOO

Name: GLSA-200512-08

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml

External Source: VUPEN

Name: ADV-2005-2856

Hyperlink:http://www.frsirt.com/english/advisories/2005/2856

External Source: VUPEN

Name: ADV-2005-2790

Hyperlink:http://www.frsirt.com/english/advisories/2005/2790

External Source: VUPEN

Name: ADV-2005-2789

Hyperlink:http://www.frsirt.com/english/advisories/2005/2789

External Source: DEBIAN

Name: DSA-940

Hyperlink:http://www.debian.org/security/2005/dsa-940

External Source: DEBIAN

Name: DSA-938

Hyperlink:http://www.debian.org/security/2005/dsa-938

External Source: DEBIAN

Name: DSA-937

Hyperlink:http://www.debian.org/security/2005/dsa-937

External Source: DEBIAN

Name: DSA-932

Hyperlink:http://www.debian.org/security/2005/dsa-932

External Source: DEBIAN

Name: DSA-931

Hyperlink:http://www.debian.org/security/2005/dsa-931

External Source: SECTRACK

Name: 1015324

Hyperlink:http://securitytracker.com/id?1015324

External Source: SECTRACK

Name: 1015309

Hyperlink:http://securitytracker.com/id?1015309

External Source: SECUNIA

Name: 18336

Hyperlink:http://secunia.com/advisories/18336

External Source: SECUNIA

Name: 18313

Hyperlink:http://secunia.com/advisories/18313

External Source: SECUNIA

Name: 18192

Hyperlink:http://secunia.com/advisories/18192

External Source: SECUNIA

Name: 18191

Hyperlink:http://secunia.com/advisories/18191

External Source: SECUNIA

Name: 18189

Hyperlink:http://secunia.com/advisories/18189

External Source: SECUNIA

Name: 18061

Hyperlink:http://secunia.com/advisories/18061

External Source: SECUNIA

Name: 18055

Hyperlink:http://secunia.com/advisories/18055

External Source: SECUNIA

Name: 18009

Hyperlink:http://secunia.com/advisories/18009

External Source: SECUNIA

Name: 17976

Hyperlink:http://secunia.com/advisories/17976

External Source: SECUNIA

Name: 17940

Hyperlink:http://secunia.com/advisories/17940

External Source: SECUNIA

Name: 17929

Hyperlink:http://secunia.com/advisories/17929

External Source: SECUNIA

Name: 17926

Hyperlink:http://secunia.com/advisories/17926

External Source: SECUNIA

Name: 17920

Hyperlink:http://secunia.com/advisories/17920

External Source: SECUNIA

Name: 17916

Hyperlink:http://secunia.com/advisories/17916

External Source: SECUNIA

Name: 17912

Hyperlink:http://secunia.com/advisories/17912

External Source: SECUNIA

Name: 17897

Hyperlink:http://secunia.com/advisories/17897

External Source: REDHAT

Name: RHSA-2005:868

Hyperlink:http://rhn.redhat.com/errata/RHSA-2005-868.html

External Source: MANDRIVA

Name: MDKSA-2006:012

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:012

External Source: MANDRIVA

Name: MDKSA-2006:010

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:010

External Source: MANDRIVA

Name: MDKSA-2006:008

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:008

External Source: MANDRIVA

Name: MDKSA-2006:006

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:006

External Source: MANDRIVA

Name: MDKSA-2006:005

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:005

External Source: MANDRIVA

Name: MDKSA-2006:004

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:004

External Source: MANDRIVA

Name: MDKSA-2006:003

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:003

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1609

Hyperlink:https://issues.rpath.com/browse/RPL-1609

External Source: FEDORA

Name: FLSA:175404

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/427990/100/0/threaded

External Source: FEDORA

Name: FLSA-2006:176751

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/427053/100/0/threaded

External Source: REDHAT

Name: RHSA-2006:0160

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0160.html

External Source: CONFIRM

Name: http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00043.html

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00043.html

External Source: FEDORA

Name: FEDORA-2005-1132

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00073.html

External Source: FEDORA

Name: FEDORA-2005-1127

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html

External Source: FEDORA

Name: FEDORA-2005-1126

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html

External Source: FEDORA

Name: FEDORA-2005-1125

Hyperlink:http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00014.html

External Source: SUSE

Name: SUSE-SR:2005:029

Hyperlink:http://www.novell.com/linux/security/advisories/2005_29_sr.html

External Source: MANDRIVA

Name: MDKSA-2006:012

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:012

External Source: MANDRIVA

Name: MDKSA-2006:011

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:011

External Source: MANDRIVA

Name: MDKSA-2006:010

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:010

External Source: MANDRIVA

Name: MDKSA-2006:008

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:008

External Source: MANDRIVA

Name: MDKSA-2006:006

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:006

External Source: MANDRIVA

Name: MDKSA-2006:005

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:005

External Source: MANDRIVA

Name: MDKSA-2006:004

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:004

External Source: MANDRIVA

Name: MDKSA-2006:003

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:003

External Source: GENTOO

Name: GLSA-200603-02

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200603-02.xml

External Source: VUPEN

Name: ADV-2007-2280

Hyperlink:http://www.frsirt.com/english/advisories/2007/2280

External Source: VUPEN

Name: ADV-2005-2787

Hyperlink:http://www.frsirt.com/english/advisories/2005/2787

External Source: DEBIAN

Name: DSA-962

Hyperlink:http://www.debian.org/security/2006/dsa-962

External Source: DEBIAN

Name: DSA-961

Hyperlink:http://www.debian.org/security/2006/dsa-961

External Source: DEBIAN

Name: DSA-950

Hyperlink:http://www.debian.org/security/2006/dsa-950

External Source: DEBIAN

Name: DSA-936

Hyperlink:http://www.debian.org/security/2006/dsa-936

External Source: SUNALERT

Name: 102972

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1

External Source: SLACKWARE

Name: SSA:2006-045-04

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747

External Source: SLACKWARE

Name: SSA:2006-045-09

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683

External Source: SREASON

Name: 236

Hyperlink:http://securityreason.com/securityalert/236

External Source: SECUNIA

Name: 26413

Hyperlink:http://secunia.com/advisories/26413

External Source: SECUNIA

Name: 25729

Hyperlink:http://secunia.com/advisories/25729

External Source: SECUNIA

Name: 19798

Hyperlink:http://secunia.com/advisories/19798

External Source: SECUNIA

Name: 19797

Hyperlink:http://secunia.com/advisories/19797

External Source: SECUNIA

Name: 19377

Hyperlink:http://secunia.com/advisories/19377

External Source: SECUNIA

Name: 19230

Hyperlink:http://secunia.com/advisories/19230

External Source: SECUNIA

Name: 19125

Hyperlink:http://secunia.com/advisories/19125

External Source: SECUNIA

Name: 18913

Hyperlink:http://secunia.com/advisories/18913

External Source: SECUNIA

Name: 18908

Hyperlink:http://secunia.com/advisories/18908

External Source: SECUNIA

Name: 18679

Hyperlink:http://secunia.com/advisories/18679

External Source: SECUNIA

Name: 18675

Hyperlink:http://secunia.com/advisories/18675

External Source: SECUNIA

Name: 18674

Hyperlink:http://secunia.com/advisories/18674

External Source: SECUNIA

Name: 18582

Hyperlink:http://secunia.com/advisories/18582

External Source: SECUNIA

Name: 18554

Hyperlink:http://secunia.com/advisories/18554

External Source: SECUNIA

Name: 18534

Hyperlink:http://secunia.com/advisories/18534

External Source: SECUNIA

Name: 18520

Hyperlink:http://secunia.com/advisories/18520

External Source: SECUNIA

Name: 18517

Hyperlink:http://secunia.com/advisories/18517

External Source: SECUNIA

Name: 18448

Hyperlink:http://secunia.com/advisories/18448

External Source: SECUNIA

Name: 18416

Hyperlink:http://secunia.com/advisories/18416

External Source: SECUNIA

Name: 18407

Hyperlink:http://secunia.com/advisories/18407

External Source: SECUNIA

Name: 18398

Hyperlink:http://secunia.com/advisories/18398

External Source: SECUNIA

Name: 18389

Hyperlink:http://secunia.com/advisories/18389

External Source: SECUNIA

Name: 18387

Hyperlink:http://secunia.com/advisories/18387

External Source: SECUNIA

Name: 18385

Hyperlink:http://secunia.com/advisories/18385

External Source: SECUNIA

Name: 18380

Hyperlink:http://secunia.com/advisories/18380

External Source: SECUNIA

Name: 18349

Hyperlink:http://secunia.com/advisories/18349

External Source: SECUNIA

Name: 18303

Hyperlink:http://secunia.com/advisories/18303

External Source: SECUNIA

Name: 18147

Hyperlink:http://secunia.com/advisories/18147

External Source: SECUNIA

Name: 17959

Hyperlink:http://secunia.com/advisories/17959

External Source: SECUNIA

Name: 17956

Hyperlink:http://secunia.com/advisories/17956

External Source: SECUNIA

Name: 17955

Hyperlink:http://secunia.com/advisories/17955

External Source: SUSE

Name: SUSE-SA:2006:001

Hyperlink:http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html

External Source: MANDRIVA

Name: MDKSA-2006:011

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:011

External Source: SGI

Name: 20060201-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U

External Source: SGI

Name: 20060101-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U

External Source: SGI

Name: 20051201-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U

External Source: SCO

Name: SCOSA-2006.21

Hyperlink:ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt

External Source: SCO

Name: SCOSA-2006.20

Hyperlink:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt

External Source: SCO

Name: SCOSA-2006.15

Hyperlink:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt