Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."
Advisories
Source ID Title
Debian DSA Debian DSA DSA-931-1 New xpdf packages fix arbitrary code execution
Debian DSA Debian DSA DSA-932-1 New kpdf packages fix arbitrary code execution
Debian DSA Debian DSA DSA-936-1 New libextractor packages fix arbitrary code execution
Debian DSA Debian DSA DSA-937-1 New tetex-bin packages fix arbitrary code execution
Debian DSA Debian DSA DSA-938-1 New koffice packages fix arbitrary code execution
Debian DSA Debian DSA DSA-940-1 New gpdf packages fix arbitrary code execution
Debian DSA Debian DSA DSA-950-1 New CUPS packages fix arbitrary code execution
Debian DSA Debian DSA DSA-961-1 New pdfkit.framework packages fix arbitrary code execution
Debian DSA Debian DSA DSA-962-1 New pdftohtml packages fix arbitrary code execution
Ubuntu USN Ubuntu USN USN-236-1 xpdf vulnerabilities
Ubuntu USN Ubuntu USN USN-236-2 xpdf vulnerabilities in kword, kpdf
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt cve-icon cve-icon
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U cve-icon cve-icon
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U cve-icon cve-icon
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U cve-icon cve-icon
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2006-0177.html cve-icon cve-icon
http://scary.beasts.org/security/CESA-2005-003.txt cve-icon cve-icon
http://secunia.com/advisories/18147 cve-icon cve-icon
http://secunia.com/advisories/18303 cve-icon cve-icon
http://secunia.com/advisories/18312 cve-icon cve-icon
http://secunia.com/advisories/18313 cve-icon cve-icon
http://secunia.com/advisories/18329 cve-icon cve-icon
http://secunia.com/advisories/18332 cve-icon cve-icon
http://secunia.com/advisories/18334 cve-icon cve-icon
http://secunia.com/advisories/18335 cve-icon cve-icon
http://secunia.com/advisories/18338 cve-icon cve-icon
http://secunia.com/advisories/18349 cve-icon cve-icon
http://secunia.com/advisories/18373 cve-icon cve-icon
http://secunia.com/advisories/18375 cve-icon cve-icon
http://secunia.com/advisories/18380 cve-icon cve-icon
http://secunia.com/advisories/18385 cve-icon cve-icon
http://secunia.com/advisories/18387 cve-icon cve-icon
http://secunia.com/advisories/18389 cve-icon cve-icon
http://secunia.com/advisories/18398 cve-icon cve-icon
http://secunia.com/advisories/18407 cve-icon cve-icon
http://secunia.com/advisories/18414 cve-icon cve-icon
http://secunia.com/advisories/18416 cve-icon cve-icon
http://secunia.com/advisories/18423 cve-icon cve-icon
http://secunia.com/advisories/18425 cve-icon cve-icon
http://secunia.com/advisories/18428 cve-icon cve-icon
http://secunia.com/advisories/18436 cve-icon cve-icon
http://secunia.com/advisories/18448 cve-icon cve-icon
http://secunia.com/advisories/18463 cve-icon cve-icon
http://secunia.com/advisories/18517 cve-icon cve-icon
http://secunia.com/advisories/18534 cve-icon cve-icon
http://secunia.com/advisories/18554 cve-icon cve-icon
http://secunia.com/advisories/18582 cve-icon cve-icon
http://secunia.com/advisories/18642 cve-icon cve-icon
http://secunia.com/advisories/18644 cve-icon cve-icon
http://secunia.com/advisories/18674 cve-icon cve-icon
http://secunia.com/advisories/18675 cve-icon cve-icon
http://secunia.com/advisories/18679 cve-icon cve-icon
http://secunia.com/advisories/18908 cve-icon cve-icon
http://secunia.com/advisories/18913 cve-icon cve-icon
http://secunia.com/advisories/19230 cve-icon cve-icon
http://secunia.com/advisories/19377 cve-icon cve-icon
http://secunia.com/advisories/25729 cve-icon cve-icon
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683 cve-icon cve-icon
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747 cve-icon cve-icon
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-931 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-932 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-937 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-938 cve-icon cve-icon
http://www.debian.org/security/2005/dsa-940 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-936 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-950 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-961 cve-icon cve-icon
http://www.debian.org/security/2006/dsa-962 cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml cve-icon cve-icon
http://www.kde.org/info/security/advisory-20051207-2.txt cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:003 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:004 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:005 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:006 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:008 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:011 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2006:012 cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00030.html cve-icon cve-icon
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00031.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2006-0160.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2006-0163.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/427053/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/427990/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/16143 cve-icon cve-icon
http://www.trustix.org/errata/2006/0002/ cve-icon cve-icon
http://www.vupen.com/english/advisories/2006/0047 cve-icon cve-icon
http://www.vupen.com/english/advisories/2007/2280 cve-icon cve-icon
https://exchange.xforce.ibmcloud.com/vulnerabilities/24023 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2005-3625 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9575 cve-icon cve-icon
https://usn.ubuntu.com/236-1/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2005-3625 cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T23:17:23.366Z

Reserved: 2005-11-16T00:00:00

Link: CVE-2005-3625

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2005-12-31T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2005-3625

cve-icon Redhat

Severity : Important

Publid Date: 2006-01-03T00:00:00Z

Links: CVE-2005-3625 - Bugzilla

cve-icon OpenCVE Enrichment

No data.