CVE-2005-3193
Summary
| CVE | CVE-2005-3193 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2005-12-07 00:03:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:H/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Xpdf | Xpdf | 0.90 | All | All | All |
| Application | Xpdf | Xpdf | 0.91 | All | All | All |
| Application | Xpdf | Xpdf | 0.92 | All | All | All |
| Application | Xpdf | Xpdf | 0.93 | All | All | All |
| Application | Xpdf | Xpdf | 1.0 | All | All | All |
| Application | Xpdf | Xpdf | 1.0a | All | All | All |
| Application | Xpdf | Xpdf | 1.1 | All | All | All |
| Application | Xpdf | Xpdf | 2.0 | All | All | All |
| Application | Xpdf | Xpdf | 2.1 | All | All | All |
| Application | Xpdf | Xpdf | 2.2 | All | All | All |
| Application | Xpdf | Xpdf | 2.3 | All | All | All |
| Application | Xpdf | Xpdf | 3.0 | All | All | All |
| Application | Xpdf | Xpdf | 3.0.1 | All | All | All |
| Application | Xpdf | Xpdf | 3.0_pl2 | All | All | All |
| Application | Xpdf | Xpdf | 3.0_pl3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Secunia - Advisories - CUPS xpdf Multiple Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Secunia - Advisories - Debian update for koffice | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| Secunia - Advisories - Fedora update for poppler | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Fedora update for gpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - KDE kpdf Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| rPath update for cups, poppler, and tetex - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Debian update for pdftohtml | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Poppler Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - GNOME gpdf Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| SecurityReason - Multiple Vendor xpdf JPX Stream Reader Heap Overflow Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| Secunia - Advisories - Gentoo update for kdegraphics / kpdf / koffice / kword | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Debian update for kpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Secunia - Advisories - Ubuntu updates for xpdf / cupsys / tetex-bin / kdegraphics / koffice | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Debian -- Security Information -- DSA-936-1 libextractor | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Secunia - Advisories - Fedora update for kdegraphics | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [SECURITY] Fedora Core 4 Update: cups-1.1.23-15.2 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Accenture | Let there be change | af854a3a-2127-422b-91ae-364da2661108 | www.idefense.com | Patch, Vendor Advisory |
| [SECURITY] Fedora Core 3 Update: tetex-2.0.2-21.5 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Secunia - Advisories - teTeX Xpdf Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| SecurityTracker.com Archives - KDE KOffice kpdf Buffer Overflows in Processing DCT and JPX Streams May Let Remote Users Execute Arbitrary Code | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| Red Hat update for gpdf - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Secunia - Advisories - Mandriva update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Fedora update for cups | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| patches.sgi.com/support/free/security/advisories/20060201-01-U | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| SCO OpenServer update for xpdf - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.sco.com | |
| Secunia - Advisories - Slackware update for kdegraphics | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| patches.sgi.com/support/free/security/advisories/20060101-01-U | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| SecurityTracker.com Archives - Xpdf Buffer Overflows in Processing DCT and JPX Streams May Let Remote Users Execute Arbitrary Code | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| [SECURITY] Fedora Core 3 Update: cups-1.1.22-0.rc1.8.8 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Secunia - Advisories - libextractor Multiple Xpdf Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Debian update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Secunia - Advisories - Red Hat update for cups | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Debian -- Security Information -- DSA-950-1 cupsys | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Secunia - Advisories - UnixWare update for CUPS | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Secunia - Advisories - Debian update for pdfkit.framework | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.sco.com | |
| Secunia - Advisories - Xpdf Multiple Buffer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| www.kde.org/info/security/advisory-20051207-2.txt | af854a3a-2127-422b-91ae-364da2661108 | www.kde.org | |
| USN-227-1: xpdf vulnerabilities | Ubuntu security notices | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntulinux.org | |
| The Slackware Linux Project: Slackware Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | slackware.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Secunia - Advisories - Fedora update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - SCO OpenServer update for CUPS | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Sun Solaris Gnome PDF Viewer Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - SUSE updates for xpdf / kpdf / gpdf / kword | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Debian update for cupsys | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian -- Page not found | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| www.trustix.org/errata/2005/0072 | af854a3a-2127-422b-91ae-364da2661108 | www.trustix.org | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| Secunia - Advisories - Trustix update for cups / curl | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - GNUStep PDFKit Framework Xpdf Multiple Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Gentoo Linux Documentation -- KPdf, KWord: Multiple overflows in included Xpdf code | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Secunia - Advisories - Slackware update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Secunia - Advisories - Gentoo updates for xpdf / gpdf / cups / poppler | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - SGI Advanced Linux Environment Multiple Updates | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| [SECURITY] Fedora Core 4 Update: kdegraphics-3.5.0-0.2.fc4 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| XPDF JPX Stream Reader Remote Heap Buffer Overflow Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| SGI Advanced Linux Environment Multiple Updates - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [SECURITY] Fedora Core 4 Update: poppler-0.4.1-1.2 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| [SECURITY] Fedora Core 4 Update: tetex-3.0-7.FC4 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Secunia - Advisories - Mandriva update for cups | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt | af854a3a-2127-422b-91ae-364da2661108 | ftp.sco.com | |
| rhn.redhat.com | Red Hat Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | Vendor Advisory |
| SuSE Security announcements: [suse-security-announce] SUSE Security Announcement: xpdf,kpdf,gpdf,kword (SUSE-SA:2006:001) | af854a3a-2127-422b-91ae-364da2661108 | lists.suse.com | |
| Secunia - Advisories - Gentoo update for teTeX / pTeX / CSTeX | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - xpdf Multiple Integer Overflow Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Debian -- Security Information -- DSA-961-1 pdfkit.framework | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Gentoo Linux Documentation -- teTeX, pTeX, CSTeX: Multiple overflows in included XPdf code | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Secunia - Advisories - Fedora update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| sunsolve.sun.com/search/document.do | af854a3a-2127-422b-91ae-364da2661108 | sunsolve.sun.com | |
| Secunia - Advisories - Fedora update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| issues.rpath.com/browse/RPL-1609 | af854a3a-2127-422b-91ae-364da2661108 | issues.rpath.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| [SECURITY] Fedora Core 3 Update: gpdf-2.8.2-5.2 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Secunia - Advisories - SGI Advanced Linux Environment Multiple Updates | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Secunia - Advisories - Red Hat update for xpdf | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| The Slackware Linux Project: Slackware Security Advisories | af854a3a-2127-422b-91ae-364da2661108 | slackware.com | |
| Debian -- Security Information -- DSA-962-1 pdftohtml | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| Secunia - Advisories - Red Hat update for kdegraphics | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Secunia - Advisories - Red Hat update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| www.kde.org/info/security/advisory-20051207-1.txt | af854a3a-2127-422b-91ae-364da2661108 | www.kde.org | |
| Security Announcement | af854a3a-2127-422b-91ae-364da2661108 | www.novell.com | |
| Secunia - Advisories - Mandriva update for tetex | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Advisories - Mandriva Linux | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Gentoo Linux Documentation -- Xpdf, GPdf, CUPS, Poppler: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.gentoo.org | |
| Secunia - Advisories - Debian update for libextractor | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| [SECURITY] Fedora Core 4 Update: poppler-0.4.3-1.3 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Advisories - Mandriva Linux OS | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| patches.sgi.com/support/free/security/advisories/20051201-01-U | af854a3a-2127-422b-91ae-364da2661108 | patches.sgi.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2007-03-14 | Mark J Cox | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
There are currently no legacy QID mappings associated with this CVE.