Secunia Research has discovered some vulnerabilities in Xpdf, which can be exploited by malicious people to compromise a user's system.

1) An array indexing error within the "DCTStream::readProgressiveDataUnit()" method in xpdf/Stream.cc can be exploited to corrupt memory via a specially crafted PDF file.

2) An integer overflow error within the "DCTStream::reset()" method in xpdf/Stream.cc can be exploited to cause a heap-based buffer overflow via a specially crafted PDF file.

3) A boundary error within the "CCITTFaxStream::lookChar()" method in xpdf/Stream.cc can be exploited to cause a heap-based buffer overflow by tricking a user into opening a PDF file containing a specially crafted "CCITTFaxDecode" filter.

Successful exploitation allows execution of arbitrary code.

The vulnerabilities are confirmed in Xpdf 3.02 with xpdf-3.02pl1.patch. Other versions may also be affected.

Solution
Apply patch xpdf-3.02pl2.patch.
Further details available to Secunia VIM customers

Provided and/or discovered by
Alin Rad Pop, Secunia Research.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2007-88/

Deep Links
Links available to Secunia VIM customers