CVE-2005-3627 - Secunia

Blog

Careers

Secunia SmallBusiness

Products

Solutions

Customers

Partner

Resources

Company

Careers

Community

CVE Reference: CVE-2005-3627
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2005-3627

Description: Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/24024 http://xforce.iss.net/xforce/xfdb/24025 UBUNTU http://www.ubuntulinux.org/support/documentation/usn/usn-236-1 TRUSTIX http://www.trustix.org/errata/2006/0002/ SUSE http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html SUNALERT http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 SLACKWARE http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683 http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747 SGI SCO SAID Secunia Advisory: SA18463 Secunia Advisory: SA18425 Secunia Advisory: SA19377 Secunia Advisory: SA19230 Secunia Advisory: SA18913 Secunia Advisory: SA18908 Secunia Advisory: SA18679 Secunia Advisory: SA18675 Secunia Advisory: SA18554 Secunia Advisory: SA18642 Secunia Advisory: SA18644 Secunia Advisory: SA18674 Secunia Advisory: SA18534 Secunia Advisory: SA18389 Secunia Advisory: SA18423 Secunia Advisory: SA18448 Secunia Advisory: SA18398 Secunia Advisory: SA18407 Secunia Advisory: SA18375 Secunia Advisory: SA18385 Secunia Advisory: SA18517 Secunia Advisory: SA18582 Secunia Advisory: SA18338 Secunia Advisory: SA18349 Secunia Advisory: SA18303 Secunia Advisory: SA18312 Secunia Advisory: SA18313 Secunia Advisory: SA18329 Secunia Advisory: SA18332 Secunia Advisory: SA18334 Secunia Advisory: SA18335 Secunia Advisory: SA18387 Secunia Advisory: SA18416 Secunia Advisory: SA18147 Secunia Advisory: SA18373 Secunia Advisory: SA18380 Secunia Advisory: SA18414 Secunia Advisory: SA18428 Secunia Advisory: SA18436 Secunia Advisory: SA25729 REDHAT http://www.redhat.com/support/errata/RHSA-2006-0160.html http://www.redhat.com/support/errata/RHSA-2006-0163.html http://rhn.redhat.com/errata/RHSA-2006-0177.html OVAL http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10200 MISC http://scary.beasts.org/security/CESA-2005-003.txt MANDRIVA http://www.mandriva.com/security/advisories?name=MDKSA-2006:011 http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 http://www.mandriva.com/security/advisories?name=MDKSA-2006:008 http://www.mandriva.com/security/advisories?name=MDKSA-2006:012 http://www.mandriva.com/security/advisories?name=MDKSA-2006:006 http://www.mandriva.com/security/advisories?name=MDKSA-2006:005 http://www.mandriva.com/security/advisories?name=MDKSA-2006:004 http://www.mandriva.com/security/advisories?name=MDKSA-2006:003 MANDRAKE http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 GENTOO http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml FEDORA http://www.securityfocus.com/archive/1/archive/1/427053/100/0/threaded http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00031.html http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00030.html http://www.securityfocus.com/archive/1/archive/1/427990/100/0/threaded DEBIAN http://www.debian.org/security/2006/dsa-961 http://www.debian.org/security/2006/dsa-962 http://www.debian.org/security/2006/dsa-936 http://www.debian.org/security/2006/dsa-950 http://www.debian.org/security/2005/dsa-938 http://www.debian.org/security/2005/dsa-940 http://www.debian.org/security/2005/dsa-937 http://www.debian.org/security/2005/dsa-932 http://www.debian.org/security/2005/dsa-931 CONFIRM http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html http://www.kde.org/info/security/advisory-20051207-2.txt BID 16143

Return to the previous page.

Products

Solutions

Customers

Partner

Resources

Company

Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)

Industry
Compliance
Technology
Integration

Customers
Testimonials

VARS
MSSP
Technology Partners
References

Factsheets
Reports
Webinars
Events

About us
Careers
Memberships
Newsroom

© 2002-2013 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability