Description

Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.

Weaknesses 1

Affected Products 15

References 116

• ftp.sco.com ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt
• ftp.sco.com ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt
• ftp.sco.com ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt
• patches.sgi.com ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U
• patches.sgi.com ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
• patches.sgi.com ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U
• bugs.debian.org http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289
• lists.suse.com http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html
• rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2005-868.html
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17897
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17908
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17912
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17916
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17920
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17921
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17926
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17929
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17940
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17955
• secunia.com http://secunia.com/advisories/17976
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18009
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18055
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18061
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18147
• secunia.com http://secunia.com/advisories/18189
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18191
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18192
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18303
• secunia.com http://secunia.com/advisories/18313
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18336
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18349
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18380
• secunia.com http://secunia.com/advisories/18385
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18387
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18389
• secunia.com http://secunia.com/advisories/18398
• secunia.com http://secunia.com/advisories/18407
• secunia.com http://secunia.com/advisories/18416
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18428
• secunia.com http://secunia.com/advisories/18436
• secunia.com http://secunia.com/advisories/18448
• secunia.com http://secunia.com/advisories/18503
• secunia.com http://secunia.com/advisories/18517
• secunia.com http://secunia.com/advisories/18534
• secunia.com http://secunia.com/advisories/18549
• secunia.com http://secunia.com/advisories/18554
• secunia.com http://secunia.com/advisories/18582
• secunia.com http://secunia.com/advisories/18674
• secunia.com http://secunia.com/advisories/18675
• secunia.com http://secunia.com/advisories/18679
• secunia.com http://secunia.com/advisories/18908
• secunia.com http://secunia.com/advisories/18913
• secunia.com http://secunia.com/advisories/19230
• secunia.com http://secunia.com/advisories/19377
• secunia.com http://secunia.com/advisories/19797
• secunia.com http://secunia.com/advisories/19798
• secunia.com http://secunia.com/advisories/25729
• secunia.com http://secunia.com/advisories/26413
• securityreason.com http://securityreason.com/securityalert/233
• securityreason.com http://securityreason.com/securityalert/234
• securitytracker.com http://securitytracker.com/id?1015309
• securitytracker.com http://securitytracker.com/id?1015324
• slackware.com http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683
• slackware.com http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747
• sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1
• debian.org http://www.debian.org/security/2005/dsa-931
• debian.org http://www.debian.org/security/2005/dsa-932
• debian.org http://www.debian.org/security/2005/dsa-937
• debian.org http://www.debian.org/security/2005/dsa-938
• debian.org http://www.debian.org/security/2005/dsa-940
• debian.org http://www.debian.org/security/2006/dsa-936
• debian.org http://www.debian.org/security/2006/dsa-950
• debian.org http://www.debian.org/security/2006/dsa-961
• debian.org http://www.debian.org/security/2006/dsa-962
• gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml
• gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml
• idefense.com http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities
  PatchVendor Advisory
• idefense.com http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities
  PatchVendor Advisory
• kde.org http://www.kde.org/info/security/advisory-20051207-1.txt
• kde.org http://www.kde.org/info/security/advisory-20051207-2.txt
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:003
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:004
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:005
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:006
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:008
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:010
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:011
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:012
• novell.com http://www.novell.com/linux/security/advisories/2005_29_sr.html
• novell.com http://www.novell.com/linux/security/advisories/2006_02_sr.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00036.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00037.html
• redhat.com http://www.redhat.com/support/errata/RHSA-2005-840.html
  Vendor Advisory
• redhat.com http://www.redhat.com/support/errata/RHSA-2005-867.html
  Vendor Advisory
• redhat.com http://www.redhat.com/support/errata/RHSA-2005-878.html
  Vendor Advisory
• redhat.com http://www.redhat.com/support/errata/RHSA-2006-0160.html
• securityfocus.com http://www.securityfocus.com/archive/1/418883/100/0/threaded
• securityfocus.com http://www.securityfocus.com/archive/1/427053/100/0/threaded
• securityfocus.com http://www.securityfocus.com/archive/1/427990/100/0/threaded
• securityfocus.com http://www.securityfocus.com/bid/15726
• securityfocus.com http://www.securityfocus.com/bid/15727
• trustix.org http://www.trustix.org/errata/2005/0072/
• ubuntulinux.org http://www.ubuntulinux.org/usn/usn-227-1
• vupen.com http://www.vupen.com/english/advisories/2005/2786
• vupen.com http://www.vupen.com/english/advisories/2005/2787
• vupen.com http://www.vupen.com/english/advisories/2005/2788
• vupen.com http://www.vupen.com/english/advisories/2005/2789
• vupen.com http://www.vupen.com/english/advisories/2005/2790
• vupen.com http://www.vupen.com/english/advisories/2005/2856
• vupen.com http://www.vupen.com/english/advisories/2007/2280
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/23443
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/23444
• issues.rpath.com https://issues.rpath.com/browse/RPL-1609
• oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9760

Remediation

• idefense.com http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities
  PatchVendor Advisory
• idefense.com http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities
  PatchVendor Advisory