Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

Project Subscriptions

Vendors Products
Conectiva Subscribe
Debian Linux Subscribe
Easy Software Products Subscribe
Libextractor Subscribe
Libextractor Subscribe
Mandrakesoft Subscribe
Mandrake Linux Subscribe
Mandrake Linux Corporate Server Subscribe
Poppler Subscribe
Poppler Subscribe
Enterprise Linux Subscribe
Enterprise Linux Desktop Subscribe
Fedora Core Subscribe
Linux Advanced Workstation Subscribe
Openserver Subscribe
Propack Subscribe
Slackware Subscribe
Slackware Linux Subscribe
Suse Linux Subscribe
Trustix Subscribe
Secure Linux Subscribe
Turbolinux Subscribe
Turbolinux Subscribe
Turbolinux Appliance Server Subscribe
Turbolinux Desktop Subscribe
Turbolinux Home Subscribe
Turbolinux Multimedia Subscribe
Turbolinux Personal Subscribe
Turbolinux Server Subscribe
Turbolinux Workstation Subscribe
Ubuntu Linux Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-931-1 New xpdf packages fix arbitrary code execution
Debian DSA Debian DSA DSA-932-1 New kpdf packages fix arbitrary code execution
Debian DSA Debian DSA DSA-936-1 New libextractor packages fix arbitrary code execution
Debian DSA Debian DSA DSA-937-1 New tetex-bin packages fix arbitrary code execution
Debian DSA Debian DSA DSA-938-1 New koffice packages fix arbitrary code execution
Debian DSA Debian DSA DSA-940-1 New gpdf packages fix arbitrary code execution
Debian DSA Debian DSA DSA-950-1 New CUPS packages fix arbitrary code execution
Debian DSA Debian DSA DSA-961-1 New pdfkit.framework packages fix arbitrary code execution
Debian DSA Debian DSA DSA-962-1 New pdftohtml packages fix arbitrary code execution
Ubuntu USN Ubuntu USN USN-236-1 xpdf vulnerabilities
Ubuntu USN Ubuntu USN USN-236-2 xpdf vulnerabilities in kword, kpdf
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt cve-icon cve-icon
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U cve-icon cve-icon
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U cve-icon cve-icon
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U cve-icon cve-icon
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2006-0177.html cve-icon cve-icon
http://scary.beasts.org/security/CESA-2005-003.txt cve-icon cve-icon
http://secunia.com/advisories/18147 cve-icon cve-icon
http://secunia.com/advisories/18303 cve-icon cve-icon
http://secunia.com/advisories/18312 cve-icon cve-icon
http://secunia.com/advisories/18313 cve-icon cve-icon
http://secunia.com/advisories/18329 cve-icon cve-icon
http://secunia.com/advisories/18332 cve-icon cve-icon
http://secunia.com/advisories/18334 cve-icon cve-icon
http://secunia.com/advisories/18335 cve-icon cve-icon
http://secunia.com/advisories/18338 cve-icon cve-icon
http://secunia.com/advisories/18349 cve-icon cve-icon
http://secunia.com/advisories/18373 cve-icon cve-icon
http://secunia.com/advisories/18375 cve-icon cve-icon
http://secunia.com/advisories/18380 cve-icon cve-icon
http://secunia.com/advisories/18385 cve-icon cve-icon
http://secunia.com/advisories/18387 cve-icon cve-icon
http://secunia.com/advisories/18389 cve-icon cve-icon
http://secunia.com/advisories/18398 cve-icon cve-icon
http://secunia.com/advisories/18407 cve-icon cve-icon
http://secunia.com/advisories/18414 cve-icon cve-icon
http://secunia.com/advisories/18416 cve-icon cve-icon
http://secunia.com/advisories/18423 cve-icon cve-icon
http://secunia.com/advisories/18425 cve-icon cve-icon
http://secunia.com/advisories/18428 cve-icon cve-icon
http://secunia.com/advisories/18436 cve-icon cve-icon
http://secunia.com/advisories/18448 cve-icon cve-icon
http://secunia.com/advisories/18463 cve-icon cve-icon
http://secunia.com/advisories/18517 cve-icon cve-icon
http://secunia.com/advisories/18534 cve-icon cve-icon
http://secunia.com/advisories/18554 cve-icon cve-icon
http://secunia.com/advisories/18582 cve-icon cve-icon
http://secunia.com/advisories/18642 cve-icon cve-icon
http://secunia.com/advisories/18644 cve-icon cve-icon
http://secunia.com/advisories/18674 cve-icon cve-icon
http://secunia.com/advisories/18675 cve-icon cve-icon
http://secunia.com/advisories/18679 cve-icon cve-icon
http://secunia.com/advisories/18908 cve-icon cve-icon
http://secunia.com/advisories/18913 cve-icon cve-icon
http://secunia.com/advisories/19230 cve-icon cve-icon
http://secunia.com/advisories/19377 cve-icon cve-icon
http://secunia.com/advisories/25729 cve-icon cve-icon
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683 cve-icon cve-icon
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-931 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-932 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-937 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-938 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-940 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-936 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-950 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-961 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-962 cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml cve-icon cve-icon
http://www.kde.org/info/security/advisory-20051207-2.txt cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:003 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:004 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:005 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:006 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:008 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:011 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:012 cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00030.html cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00031.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2006-0160.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2006-0163.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/427053/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/427990/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/16143 cve-icon cve-icon
http://www.trustix.org/errata/2006/0002/ cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/0047 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/2280 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/24023 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2005-3625 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9575 cve-icon cve-icon
https://usn.ubuntu.com/236-1/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2005-3625 cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T23:17:23.366Z

Reserved: 2005-11-16T05:00:00.000Z

Link: CVE-2005-3625

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2005-12-31T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2005-3625

cve-icon Redhat

Severity : Important

Publid Date: 2006-01-03T00:00:00Z

Links: CVE-2005-3625 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses