CVE-2005-3192: Buffer Overflow
First published: Thu Dec 08 2005(Updated: )
Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xpdf | =3.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289
- http://www.redhat.com/support/errata/RHSA-2005-840.html
- http://www.securityfocus.com/bid/15725
- http://secunia.com/advisories/17897/
- http://securitytracker.com/id?1015309
- http://securitytracker.com/id?1015324
- http://secunia.com/advisories/17912
- http://secunia.com/advisories/17916
- http://secunia.com/advisories/17920
- http://secunia.com/advisories/17921
- http://secunia.com/advisories/17929
- http://secunia.com/advisories/17940
- http://www.kde.org/info/security/advisory-20051207-1.txt
- http://www.ubuntulinux.org/usn/usn-227-1
- http://secunia.com/advisories/17908
- http://secunia.com/advisories/17976
- http://secunia.com/advisories/18009
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00036.html
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00037.html
- http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml
- http://secunia.com/advisories/18055
- http://secunia.com/advisories/18061
- http://www.redhat.com/support/errata/RHSA-2005-867.html
- http://www.redhat.com/support/errata/RHSA-2005-878.html
- http://secunia.com/advisories/17926
- http://rhn.redhat.com/errata/RHSA-2005-868.html
- http://secunia.com/advisories/18191
- http://secunia.com/advisories/18192
- http://secunia.com/advisories/18189
- http://www.kde.org/info/security/advisory-20051207-2.txt
- http://scary.beasts.org/security/CESA-2005-003.txt
- http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml
- http://www.trustix.org/errata/2005/0072/
- http://secunia.com/advisories/18313
- http://secunia.com/advisories/18336
- http://www.debian.org/security/2005/dsa-931
- http://www.debian.org/security/2005/dsa-932
- http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html
- http://secunia.com/advisories/18387
- http://secunia.com/advisories/18416
- http://secunia.com/advisories/18349
- http://secunia.com/advisories/18385
- http://secunia.com/advisories/18389
- http://secunia.com/advisories/18448
- http://www.debian.org/security/2006/dsa-936
- http://www.debian.org/security/2006/dsa-950
- http://www.redhat.com/support/errata/RHSA-2006-0160.html
- http://www.novell.com/linux/security/advisories/2006_02_sr.html
- http://secunia.com/advisories/18398
- http://secunia.com/advisories/18407
- http://secunia.com/advisories/18534
- http://secunia.com/advisories/18549
- http://secunia.com/advisories/18582
- http://secunia.com/advisories/18303
- http://secunia.com/advisories/18517
- http://secunia.com/advisories/18554
- http://www.debian.org/security/2006/dsa-961
- http://www.debian.org/security/2006/dsa-962
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html
- http://secunia.com/advisories/17955
- http://secunia.com/advisories/18674
- http://secunia.com/advisories/18675
- http://secunia.com/advisories/18679
- http://secunia.com/advisories/18908
- http://secunia.com/advisories/18913
- http://secunia.com/advisories/19230
- http://secunia.com/advisories/19377
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683
- http://www.debian.org/security/2006/dsa-937
- http://secunia.com/advisories/18503
- http://secunia.com/advisories/18380
- http://secunia.com/advisories/18428
- http://secunia.com/advisories/18436
- http://www.novell.com/linux/security/advisories/2005_29_sr.html
- http://secunia.com/advisories/19797
- http://secunia.com/advisories/19798
- https://issues.rpath.com/browse/RPL-1609
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:003
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:004
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:005
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:006
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:008
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:011
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1
- http://secunia.com/advisories/25729
- http://secunia.com/advisories/26413
- http://securityreason.com/securityalert/235
- http://securityreason.com/securityalert/240
- http://www.vupen.com/english/advisories/2005/2790
- http://www.vupen.com/english/advisories/2005/2786
- http://www.vupen.com/english/advisories/2005/2787
- http://www.vupen.com/english/advisories/2007/2280
- http://www.vupen.com/english/advisories/2005/2788
- http://www.vupen.com/english/advisories/2005/2856
- http://www.vupen.com/english/advisories/2005/2789
- http://www.vupen.com/english/advisories/2005/2755
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:010
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23442
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10914
- http://www.securityfocus.com/archive/1/427990/100/0/threaded
- http://www.securityfocus.com/archive/1/427053/100/0/threaded
- http://www.securityfocus.com/archive/1/418883/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-3192?
CVE-2005-3192 has a high severity due to its potential for remote code execution.
How do I fix CVE-2005-3192?
To fix CVE-2005-3192, upgrade to a version of Xpdf that is not vulnerable, specifically version 3.01 or later.
Who is affected by CVE-2005-3192?
CVE-2005-3192 affects any software utilizing Xpdf version 3.0.1, including Poppler and KDE kpdf.
What are the consequences of exploiting CVE-2005-3192?
Exploiting CVE-2005-3192 could allow an attacker to execute arbitrary code on the affected system.
Is there a patch available for CVE-2005-3192?
Yes, a patch for CVE-2005-3192 can be found in updates for affected software packages.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/remedy
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/xpdf
- canonical/xpdf
- version/xpdf/3.0.1