Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-932-1 | New kpdf packages fix arbitrary code execution |
Debian DSA |
DSA-936-1 | New libextractor packages fix arbitrary code execution |
Debian DSA |
DSA-938-1 | New koffice packages fix arbitrary code execution |
Debian DSA |
DSA-950-1 | New CUPS packages fix arbitrary code execution |
Debian DSA |
DSA-961-1 | New pdfkit.framework packages fix arbitrary code execution |
Debian DSA |
DSA-962-1 | New pdftohtml packages fix arbitrary code execution |
EUVD |
EUVD-2005-3192 | Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated. |
Ubuntu USN |
USN-227-1 | xpdf vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2024-08-07T23:01:59.055Z
Reserved: 2005-10-14T00:00:00
Link: CVE-2005-3193
No data.
Status : Deferred
Published: 2005-12-07T00:03:00.000
Modified: 2025-04-03T01:03:51.193
Link: CVE-2005-3193
OpenCVE Enrichment
No data.
Debian DSA
EUVD
Ubuntu USN