CVE-2005-0064: Buffer Overflow
Published Jan 19, 2005
·Updated
Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.
Affected Software
32 affected components
xpdf Xpdf=0.2
xpdf Xpdf=0.3
xpdf Xpdf=0.4
xpdf Xpdf=0.5
xpdf Xpdf=0.5a
xpdf Xpdf=0.6
xpdf Xpdf=0.7
xpdf Xpdf=0.7a
xpdf Xpdf=0.80
xpdf Xpdf=0.90
xpdf Xpdf=0.91
xpdf Xpdf=0.91a
xpdf Xpdf=0.91b
xpdf Xpdf=0.91c
xpdf Xpdf=0.92
xpdf Xpdf=0.92a
xpdf Xpdf=0.92b
xpdf Xpdf=0.92c
xpdf Xpdf=0.92d
xpdf Xpdf=0.92e
xpdf Xpdf=0.93
xpdf Xpdf=0.93a
xpdf Xpdf=0.93b
xpdf Xpdf=0.93c
xpdf Xpdf=1.0
xpdf Xpdf=1.0a
xpdf Xpdf=1.1
xpdf Xpdf=2.0
xpdf Xpdf=2.1
xpdf Xpdf=2.2
xpdf Xpdf=2.3
xpdf Xpdf=3.0
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Jan 19, 2005
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-0064?
CVE-2005-0064 has a high severity level as it allows remote attackers to execute arbitrary code via specially crafted PDF files.
2
How do I fix CVE-2005-0064?
To fix CVE-2005-0064, upgrade to a patched version of xpdf that addresses the buffer overflow vulnerability.
3
Which versions of xpdf are affected by CVE-2005-0064?
CVE-2005-0064 affects xpdf versions prior to 3.01, including versions 2.0, 0.91a, and others.
4
What types of attacks are possible with CVE-2005-0064?
CVE-2005-0064 enables attackers to perform remote code execution through crafted PDF files.
5
Is CVE-2005-0064 still a risk today?
While CVE-2005-0064 is dated, systems running the vulnerable versions of xpdf without updates remain at risk.