Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."
Metrics
Affected Vendors & Products
Advisories
Source | ID | Title |
---|---|---|
![]() |
DSA-931-1 | New xpdf packages fix arbitrary code execution |
![]() |
DSA-932-1 | New kpdf packages fix arbitrary code execution |
![]() |
DSA-936-1 | New libextractor packages fix arbitrary code execution |
![]() |
DSA-937-1 | New tetex-bin packages fix arbitrary code execution |
![]() |
DSA-938-1 | New koffice packages fix arbitrary code execution |
![]() |
DSA-940-1 | New gpdf packages fix arbitrary code execution |
![]() |
DSA-950-1 | New CUPS packages fix arbitrary code execution |
![]() |
DSA-961-1 | New pdfkit.framework packages fix arbitrary code execution |
![]() |
DSA-962-1 | New pdftohtml packages fix arbitrary code execution |
![]() |
USN-236-1 | xpdf vulnerabilities |
![]() |
USN-236-2 | xpdf vulnerabilities in kword, kpdf |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.

Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-07T23:17:23.366Z
Reserved: 2005-11-16T00:00:00
Link: CVE-2005-3625

No data.

Status : Deferred
Published: 2005-12-31T05:00:00.000
Modified: 2025-04-03T01:03:51.193
Link: CVE-2005-3625


No data.