CVE-2005-2097: Low severity xpdf Xpdf vulnerability

Published Aug 16, 2005

Updated

xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.

Affected Software

4 affected components

xpdf Xpdf=3.0_pl3

KDE kpdf

xpdf Xpdf=3.0_pl2

xpdf Xpdf=3.0

Event History

Aug 16, 2005

CVE Published

04:00 AM

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-2097?

CVE-2005-2097 has a moderate severity rating due to its potential for causing denial of service through disk consumption.

How do I fix CVE-2005-2097?

To fix CVE-2005-2097, you should upgrade xpdf or kpdf to the latest patched version that addresses this vulnerability.

What types of PDF files are affected by CVE-2005-2097?

CVE-2005-2097 affects PDF files that contain a improperly formatted 'loca' table.

Who is affected by CVE-2005-2097?

Users of xpdf versions 3.0, 3.0_pl2, 3.0_pl3 and kpdf are affected by CVE-2005-2097.

What are the potential impacts of CVE-2005-2097?

The potential impacts of CVE-2005-2097 include the creation of large temporary files leading to disk space exhaustion and application hangs.