CVE-2005-0064

Published: May 2, 2005Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.

Affected (32)

Products: Xpdf: Xpdf

Xpdf

1 product

Xpdf

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Xpdf Xpdf	Version 0.2
Xpdf Xpdf	Version 0.3
Xpdf Xpdf	Version 0.4
Xpdf Xpdf	Version 0.5
Xpdf Xpdf	Version 0.5a
Xpdf Xpdf	Version 0.6
Xpdf Xpdf	Version 0.7
Xpdf Xpdf	Version 0.7a
Xpdf Xpdf	Version 0.80
Xpdf Xpdf	Version 0.90
Xpdf Xpdf	Version 0.91
Xpdf Xpdf	Version 0.91a
Xpdf Xpdf	Version 0.91b
Xpdf Xpdf	Version 0.91c
Xpdf Xpdf	Version 0.92
Xpdf Xpdf	Version 0.92a
Xpdf Xpdf	Version 0.92b
Xpdf Xpdf	Version 0.92c
Xpdf Xpdf	Version 0.92d
Xpdf Xpdf	Version 0.92e
Xpdf Xpdf	Version 0.93
Xpdf Xpdf	Version 0.93a
Xpdf Xpdf	Version 0.93b
Xpdf Xpdf	Version 0.93c
Xpdf Xpdf	Version 1.0
Xpdf Xpdf	Version 1.0a
Xpdf Xpdf	Version 1.1
Xpdf Xpdf	Version 2.0
Xpdf Xpdf	Version 2.1
Xpdf Xpdf	Version 2.2
Xpdf Xpdf	Version 2.3
Xpdf Xpdf	Version 3.0

References (52)

ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.00pl3.patch (unsafe URL)

Source: cve@mitre.org

Patch

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.42/SCOSA-2005.42.txt (unsafe URL)

Source: cve@mitre.org

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000921

Source: cve@mitre.org

PatchVendor Advisory

http://marc.info/?l=bugtraq&m=110625368019554&w=2

Source: cve@mitre.org

http://secunia.com/advisories/17277

Source: cve@mitre.org

http://www.debian.org/security/2005/dsa-645

Source: cve@mitre.org

PatchVendor Advisory

http://www.debian.org/security/2005/dsa-648

Source: cve@mitre.org

PatchVendor Advisory

http://www.idefense.com/application/poi/display?id=186&type=vulnerabilities

Source: cve@mitre.org

ExploitPatchVendor Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2005:016

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2005:017

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2005:018

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2005:019

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2005:020

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2005:021

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2005-026.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2005-034.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2005-053.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2005-057.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2005-059.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2005-066.html

Source: cve@mitre.org

PatchVendor Advisory

http://www.trustix.org/errata/2005/0003/

Source: cve@mitre.org

PatchVendor Advisory

https://bugzilla.fedora.us/show_bug.cgi?id=2352

Source: cve@mitre.org

PatchVendor Advisory

https://bugzilla.fedora.us/show_bug.cgi?id=2353

Source: cve@mitre.org

PatchVendor Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11781

Source: cve@mitre.org

https://security.gentoo.org/glsa/200501-28

Source: cve@mitre.org

https://security.gentoo.org/glsa/200502-10

Source: cve@mitre.org

ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.00pl3.patch (unsafe URL)