Description: Some vulnerabilities have been reported in Xpdf, which can be exploited by malicious people to compromise a user's system.
1) An integer overflow within "StreamPredictor::StreamPredictor()" in xpdf/Stream.cc can be exploited to cause a heap-based buffer overflow by e.g. tricking a user into opening a specially crafted PDF file in Xpdf.
2) A boundary error within "StreamPredictor::getNextLine()" in xpdf/Stream.cc can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into opening a specially crafted PDF file in Xpdf.
The vulnerabilities are confirmed in version 3.02. Other versions may also be affected.
Provided and/or discovered by: Red Hat credits Maurycy Prodeus.
Changelog: 2007-08-17: Added vulnerability #2 and increased criticality based on additional research by Secunia Research.
2007-09-25: Added CVE reference.
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
