CVE-2005-3191: Buffer Overflow
Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3191?
CVE-2005-3191 is considered to have a high severity due to multiple heap-based buffer overflows that can be exploited.
How do I fix CVE-2005-3191?
To fix CVE-2005-3191, you should upgrade to a version of Xpdf that is newer than 3.01, which no longer contains this vulnerability.
What software is affected by CVE-2005-3191?
CVE-2005-3191 affects multiple software products including Xpdf, Poppler, and KDE kpdf among others.
What are the potential impacts of exploiting CVE-2005-3191?
Exploiting CVE-2005-3191 may allow an attacker to execute arbitrary code or crash the application.
When was CVE-2005-3191 disclosed?
CVE-2005-3191 was publicly disclosed in 2005, prompting the need for immediate security updates.