Description

Heap-based buffer overflow in the JPXStream::readCodestream function in the JPX stream parsing code (JPXStream.c) for xpdf 3.01 and earlier, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, (4) CUPS, and (5) libextractor allows user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with large size values that cause insufficient memory to be allocated.

Weaknesses 1

Affected Products 15

References 111

• ftp.sco.com ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt
• ftp.sco.com ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt
• ftp.sco.com ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt
• patches.sgi.com ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U
• patches.sgi.com ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
• patches.sgi.com ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U
• lists.suse.com http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html
• rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2005-868.html
• secunia.com http://secunia.com/advisories/17897
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17912
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17916
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17920
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17926
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17929
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17940
  Vendor Advisory
• secunia.com http://secunia.com/advisories/17955
• secunia.com http://secunia.com/advisories/17956
• secunia.com http://secunia.com/advisories/17959
• secunia.com http://secunia.com/advisories/17976
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18009
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18055
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18061
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18147
• secunia.com http://secunia.com/advisories/18189
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18191
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18192
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18303
• secunia.com http://secunia.com/advisories/18313
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18336
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18349
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18380
• secunia.com http://secunia.com/advisories/18385
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18387
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18389
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18398
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18407
• secunia.com http://secunia.com/advisories/18416
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18448
  Vendor Advisory
• secunia.com http://secunia.com/advisories/18517
• secunia.com http://secunia.com/advisories/18520
• secunia.com http://secunia.com/advisories/18534
• secunia.com http://secunia.com/advisories/18554
• secunia.com http://secunia.com/advisories/18582
• secunia.com http://secunia.com/advisories/18674
• secunia.com http://secunia.com/advisories/18675
• secunia.com http://secunia.com/advisories/18679
• secunia.com http://secunia.com/advisories/18908
• secunia.com http://secunia.com/advisories/18913
• secunia.com http://secunia.com/advisories/19125
• secunia.com http://secunia.com/advisories/19230
• secunia.com http://secunia.com/advisories/19377
• secunia.com http://secunia.com/advisories/19797
• secunia.com http://secunia.com/advisories/19798
• secunia.com http://secunia.com/advisories/25729
• secunia.com http://secunia.com/advisories/26413
• securityreason.com http://securityreason.com/securityalert/236
• securitytracker.com http://securitytracker.com/id?1015309
• securitytracker.com http://securitytracker.com/id?1015324
• slackware.com http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683
• slackware.com http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747
• sunsolve.sun.com http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1
• debian.org http://www.debian.org/security/2005/dsa-931
• debian.org http://www.debian.org/security/2005/dsa-932
• debian.org http://www.debian.org/security/2005/dsa-937
• debian.org http://www.debian.org/security/2005/dsa-938
• debian.org http://www.debian.org/security/2005/dsa-940
• debian.org http://www.debian.org/security/2006/dsa-936
• debian.org http://www.debian.org/security/2006/dsa-950
• debian.org http://www.debian.org/security/2006/dsa-961
• debian.org http://www.debian.org/security/2006/dsa-962
• gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml
• gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml
• gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200603-02.xml
• idefense.com http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities&flashstatus=true
  PatchVendor Advisory
• kde.org http://www.kde.org/info/security/advisory-20051207-1.txt
• kde.org http://www.kde.org/info/security/advisory-20051207-2.txt
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:003
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:004
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:005
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:006
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:008
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:010
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:011
• mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:012
• novell.com http://www.novell.com/linux/security/advisories/2005_29_sr.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00014.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00022.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00036.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00037.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00073.html
• redhat.com http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00043.html
• redhat.com http://www.redhat.com/support/errata/RHSA-2005-840.html
  Vendor Advisory
• redhat.com http://www.redhat.com/support/errata/RHSA-2005-867.html
  Vendor Advisory
• redhat.com http://www.redhat.com/support/errata/RHSA-2005-878.html
  Vendor Advisory
• redhat.com http://www.redhat.com/support/errata/RHSA-2006-0160.html
  Vendor Advisory
• securityfocus.com http://www.securityfocus.com/archive/1/418883/100/0/threaded
• securityfocus.com http://www.securityfocus.com/archive/1/427053/100/0/threaded
• securityfocus.com http://www.securityfocus.com/archive/1/427990/100/0/threaded
• securityfocus.com http://www.securityfocus.com/bid/15721
• trustix.org http://www.trustix.org/errata/2005/0072/
• ubuntulinux.org http://www.ubuntulinux.org/usn/usn-227-1
• vupen.com http://www.vupen.com/english/advisories/2005/2787
• vupen.com http://www.vupen.com/english/advisories/2005/2789
• vupen.com http://www.vupen.com/english/advisories/2005/2790
• vupen.com http://www.vupen.com/english/advisories/2005/2856
• vupen.com http://www.vupen.com/english/advisories/2007/2280
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/23441
• issues.rpath.com https://issues.rpath.com/browse/RPL-1609
• oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11440

Remediation

• idefense.com http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities&flashstatus=true
  PatchVendor Advisory