CVE-2007-0104: Input Validation

Published Jan 9, 2007

Updated

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Affected Software

17 affected components

xpdf Xpdf=3.0

xpdf Xpdf=3.0.1

xpdf Xpdf=3.0.1_pl1

xpdf Xpdf=3.0.1_pl2

xpdf Xpdf=3.0_pl2

KDE kde=3.2

KDE kde=3.2.1

KDE kde=3.2.2

KDE kde=3.2.3

KDE kde=3.3

KDE kde=3.3.1

KDE kde=3.3.2

KDE kde=3.4

KDE kde=3.4.1

KDE kde=3.4.2

KDE kde=3.4.3

KDE kde=3.5

Event History

Jan 9, 2007

CVE Published

12:28 AM

Data Sourced

via NVD·12:28 AM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0104?

CVE-2007-0104 has been classified with a potential severity level that includes denial of service and arbitrary code execution.

How do I fix CVE-2007-0104?

To mitigate CVE-2007-0104, users are advised to upgrade to the latest versions of affected software such as xpdf or KDE.

What software is affected by CVE-2007-0104?

CVE-2007-0104 affects various versions of xpdf, kpdf, and poppler, particularly prior to specified versions.

Can CVE-2007-0104 cause data loss?

Yes, CVE-2007-0104 could potentially lead to memory corruption which might result in data loss.

Is CVE-2007-0104 exploitable remotely?

Yes, CVE-2007-0104 can be exploited by remote attackers, potentially leading to significant impacts such as denial of service.