CVE-2005-3193: Buffer Overflow

Published Dec 7, 2005

Updated

Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated.

Affected Software

15 affected components

xpdf Xpdf=0.90

xpdf Xpdf=0.91

xpdf Xpdf=0.92

xpdf Xpdf=0.93

xpdf Xpdf=1.0

xpdf Xpdf=1.0a

xpdf Xpdf=1.1

xpdf Xpdf=2.0

xpdf Xpdf=2.1

xpdf Xpdf=2.2

xpdf Xpdf=2.3

xpdf Xpdf=3.0

xpdf Xpdf=3.0.1

xpdf Xpdf=3.0_pl2

xpdf Xpdf=3.0_pl3

Remediation

Patch Available

http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities&flashstatus=true

Event History

Dec 7, 2005

CVE Published

12:03 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3193?

CVE-2005-3193 is classified as a moderate severity vulnerability due to its potential to cause denial of service.

How do I fix CVE-2005-3193?

To fix CVE-2005-3193, users should update Xpdf to version 3.0.1 or later.

Which versions of Xpdf are affected by CVE-2005-3193?

CVE-2005-3193 affects Xpdf versions 0.90 through 3.0_pl3.

What type of vulnerability is CVE-2005-3193?

CVE-2005-3193 is a heap-based buffer overflow vulnerability.

Can CVE-2005-3193 be exploited remotely?

CVE-2005-3193 requires user-assisted actions to exploit, which means it cannot be exploited remotely without user interaction.