CVE-2005-3191
Summary
| CVE | CVE-2005-3191 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2005-12-07 01:03:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:H/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Xpdf | Xpdf | 0.90 | All | All | All |
| Application | Xpdf | Xpdf | 0.91 | All | All | All |
| Application | Xpdf | Xpdf | 0.92 | All | All | All |
| Application | Xpdf | Xpdf | 0.93 | All | All | All |
| Application | Xpdf | Xpdf | 1.0 | All | All | All |
| Application | Xpdf | Xpdf | 1.0a | All | All | All |
| Application | Xpdf | Xpdf | 1.1 | All | All | All |
| Application | Xpdf | Xpdf | 2.0 | All | All | All |
| Application | Xpdf | Xpdf | 2.1 | All | All | All |
| Application | Xpdf | Xpdf | 2.2 | All | All | All |
| Application | Xpdf | Xpdf | 2.3 | All | All | All |
| Application | Xpdf | Xpdf | 3.0 | All | All | All |
| Application | Xpdf | Xpdf | 3.0.1 | All | All | All |
| Application | Xpdf | Xpdf | 3.0_pl2 | All | All | All |
| Application | Xpdf | Xpdf | 3.0_pl3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Secunia - Advisories - CUPS xpdf Multiple Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Secunia - Advisories - Debian update for koffice | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| Multiple Vendor xpdf DCTStream Progressive Heap Overflow - CXSecurity.com | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| Secunia - Advisories - KDE kpdf Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| XPDF DCTStream Progressive Remote Heap Buffer Overflow Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| rPath update for cups, poppler, and tetex - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Debian update for pdftohtml | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Poppler Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - GNOME gpdf Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Gentoo update for kdegraphics / kpdf / koffice / kword | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Debian update for kpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | Vendor Advisory |
| Secunia - Advisories - Ubuntu updates for xpdf / cupsys / tetex-bin / kdegraphics / koffice | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Debian -- Security Information -- DSA-936-1 libextractor | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| [SECURITY] Fedora Core 4 Update: cups-1.1.23-15.2 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| [SECURITY] Fedora Core 3 Update: tetex-2.0.2-21.5 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Secunia - Advisories - teTeX Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| SecurityTracker.com Archives - KDE KOffice kpdf Buffer Overflows in Processing DCT and JPX Streams May Let Remote Users Execute Arbitrary Code | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| Red Hat update for gpdf - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Secunia - Advisories - Mandriva update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Fedora update for cups | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| patches.sgi.com/support/free/security/advisories/20060201-01-U | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| SCO OpenServer update for xpdf - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.sco.com | |
| Secunia - Advisories - Slackware update for kdegraphics | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| patches.sgi.com/support/free/security/advisories/20060101-01-U | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| SecurityTracker.com Archives - Xpdf Buffer Overflows in Processing DCT and JPX Streams May Let Remote Users Execute Arbitrary Code | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| [SECURITY] Fedora Core 3 Update: cups-1.1.22-0.rc1.8.8 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Secunia - Advisories - libextractor Multiple Xpdf Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Debian update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Secunia - Advisories - SUSE update for multiple packages | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - KOffice KWord PDF Filter Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Secunia - Advisories - Red Hat update for cups | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Debian -- Security Information -- DSA-950-1 cupsys | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Secunia - Advisories - UnixWare update for CUPS | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Secunia - Advisories - Debian update for pdfkit.framework | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.sco.com | |
| Secunia - Advisories - Xpdf Multiple Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| www.kde.org/info/security/advisory-20051207-2.txt | af854a3a-2127-422b-91ae-364da2661108 | www.kde.org | |
| USN-227-1: xpdf vulnerabilities | Ubuntu security notices | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntulinux.org | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| The Slackware Linux Project: Slackware Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | slackware.com | |
| Secunia - Advisories - Fedora update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - SCO OpenServer update for CUPS | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Accenture | Let there be change | af854a3a-2127-422b-91ae-364da2661108 | www.idefense.com | Patch, Vendor Advisory |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Sun Solaris Gnome PDF Viewer Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - SUSE updates for xpdf / kpdf / gpdf / kword | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Debian update for cupsys | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - pdftohtml Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Multiple Vendor xpdf DCTStream Baseline Heap Overflow Vulnerability - CXSecurity.com | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| www.trustix.org/errata/2005/0072 | af854a3a-2127-422b-91ae-364da2661108 | www.trustix.org | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| Secunia - Advisories - Trustix update for cups / curl | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - GNUStep PDFKit Framework Xpdf Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Gentoo Linux Documentation -- KPdf, KWord: Multiple overflows in included Xpdf code | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Secunia - Advisories - Slackware update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Debian update for gpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Secunia - Advisories - Gentoo updates for xpdf / gpdf / cups / poppler | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Accenture | Let there be change | af854a3a-2127-422b-91ae-364da2661108 | www.idefense.com | Patch, Vendor Advisory |
| Secunia - Advisories - SGI Advanced Linux Environment Multiple Updates | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| XPDF DCTStream Baseline Remote Heap Buffer Overflow Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| SGI Advanced Linux Environment Multiple Updates - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [SECURITY] Fedora Core 4 Update: tetex-3.0-7.FC4 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Secunia - Advisories - Mandriva update for cups | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.sco.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| SuSE Security announcements: [suse-security-announce] SUSE Security Announcement: xpdf,kpdf,gpdf,kword (SUSE-SA:2006:001) | af854a3a-2127-422b-91ae-364da2661108 | lists.suse.com | |
| Secunia - Advisories - xpdf Multiple Integer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Security Information -- DSA-961-1 pdfkit.framework | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Secunia - Advisories - Fedora update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| sunsolve.sun.com/search/document.do | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | |
| Secunia - Advisories - Fedora update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| issues.rpath.com/browse/RPL-1609 | af854a3a-2127-422b-91ae-364da2661108 | issues.rpath.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| #342289 - xpdf security problems partially affect pdftohtml as well - Debian Bug report logs | af854a3a-2127-422b-91ae-364da2661108 | bugs.debian.org | |
| Secunia - Advisories - SGI Advanced Linux Environment Multiple Updates | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SUSE update for multiple packages - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Red Hat update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| The Slackware Linux Project: Slackware Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | slackware.com | |
| Debian -- Security Information -- DSA-962-1 pdftohtml | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Secunia - Advisories - Red Hat update for kdegraphics | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Red Hat update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| www.kde.org/info/security/advisory-20051207-1.txt | af854a3a-2127-422b-91ae-364da2661108 | www.kde.org | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| Secunia - Advisories - Mandriva update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Gentoo Linux Documentation -- Xpdf, GPdf, CUPS, Poppler: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Secunia - Advisories - Debian update for libextractor | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Secunia - Advisories - Debian update for tetex-bin | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| patches.sgi.com/support/free/security/advisories/20051201-01-U | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-03-14 | Mark J Cox | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
There are currently no legacy QID mappings associated with this CVE.