CVE-2005-3627

Published: Dec 31, 2005Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.

Affected (1)

Products: Xpdf: Xpdf

Xpdf

1 product

Xpdf

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xpdf Xpdf	All versions

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (172)

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U (unsafe URL)

Source: secalert@redhat.com

ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U (unsafe URL)

Source: secalert@redhat.com

http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html

Source: secalert@redhat.com

PatchVendor Advisory

http://rhn.redhat.com/errata/RHSA-2006-0177.html

Source: secalert@redhat.com

PatchVendor Advisory

http://scary.beasts.org/security/CESA-2005-003.txt

Source: secalert@redhat.com

ExploitVendor Advisory

http://secunia.com/advisories/18147

Source: secalert@redhat.com

http://secunia.com/advisories/18303

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18312

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18313

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18329

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18332

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18334

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18335

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18338

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18349

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18373

Source: secalert@redhat.com

http://secunia.com/advisories/18375

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18380

Source: secalert@redhat.com

http://secunia.com/advisories/18385

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18387

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18389

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18398

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18407

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18414

Source: secalert@redhat.com

http://secunia.com/advisories/18416

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18423

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18425

Source: secalert@redhat.com

http://secunia.com/advisories/18428

Source: secalert@redhat.com

http://secunia.com/advisories/18436

Source: secalert@redhat.com

http://secunia.com/advisories/18448

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18463

Source: secalert@redhat.com

http://secunia.com/advisories/18517

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18534

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18554

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18582

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/18642

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18644

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18674

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18675

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18679

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18908

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/18913

Source: secalert@redhat.com

http://secunia.com/advisories/19230

Source: secalert@redhat.com

http://secunia.com/advisories/19377

Source: secalert@redhat.com

http://secunia.com/advisories/25729

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1

Source: secalert@redhat.com

http://www.debian.org/security/2005/dsa-931

Source: secalert@redhat.com

http://www.debian.org/security/2005/dsa-932

Source: secalert@redhat.com

http://www.debian.org/security/2005/dsa-937

Source: secalert@redhat.com

http://www.debian.org/security/2005/dsa-938

Source: secalert@redhat.com

http://www.debian.org/security/2005/dsa-940

Source: secalert@redhat.com

http://www.debian.org/security/2006/dsa-936

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2006/dsa-950

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2006/dsa-961

Source: secalert@redhat.com

PatchVendor Advisory

http://www.debian.org/security/2006/dsa-962

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml

Source: secalert@redhat.com

PatchVendor Advisory

http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml

Source: secalert@redhat.com

http://www.kde.org/info/security/advisory-20051207-2.txt

Source: secalert@redhat.com

Patch

http://www.mandriva.com/security/advisories?name=MDKSA-2006:003

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:004

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:005

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:006

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:008

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:010

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:011

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDKSA-2006:012

Source: secalert@redhat.com

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html

Source: secalert@redhat.com

Patch

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html

Source: secalert@redhat.com

Patch

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00030.html

Source: secalert@redhat.com

http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00031.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2006-0160.html

Source: secalert@redhat.com

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2006-0163.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/427053/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/427990/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/16143

Source: secalert@redhat.com

Patch

http://www.trustix.org/errata/2006/0002/

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/0047

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2007/2280

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/24024

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/24025

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10200

Source: secalert@redhat.com

https://usn.ubuntu.com/236-1/

Source: secalert@redhat.com

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt (unsafe URL)