Vulnerability Name: CVE-2004-0888 (CCN-17818) Assigned: 2004-10-21 Published: 2004-10-21 Updated: 2017-10-11 Summary: Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889 . CVSS v3 Severity: 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H )Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): ChangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-Other Vulnerability Consequences: Gain Access References: Source: MITRE Type: CNACVE-2004-0888 Source: MITRE Type: CNACVE-2005-0206 Source: CCN Type: Conectiva Linux Security Announcement CLSA-2004:886Fixes for xpdf vulnerabilities Source: CONECTIVA Type: UNKNOWNCLA-2004:886 Source: SUSE Type: UNKNOWNSUSE-SA:2004:039 Source: FEDORA Type: UNKNOWNFLSA:2352 Source: CCN Type: RHSA-2004-543cups security update Source: CCN Type: RHSA-2004-592xpdf security update Source: CCN Type: RHSA-2005-034xpdf security update Source: CCN Type: RHSA-2005-053CUPS security update Source: CCN Type: RHSA-2005-057gpdf security update Source: CCN Type: RHSA-2005-066kdegraphics security update Source: CCN Type: RHSA-2005-132cups security update Source: CCN Type: RHSA-2005-213xpdf security update Source: CCN Type: RHSA-2005-354tetex security update Source: CCN Type: ASA-2008-179cups security update (RHSA-2008-0206) Source: CCN Type: CIAC Information Bulletin P-019Red Hat Updated CUPS Packages Fix Security Issues Source: CCN Type: CIAC Information Bulletin P-142XPDF/GPDF - CUPS Vulnerabilities Source: CCN Type: CIAC INFORMATION BULLETIN P-171SGI Advanced Linux Environment 3 Security Update #33 Source: DEBIAN Type: UNKNOWNDSA-573 Source: DEBIAN Type: UNKNOWNDSA-581 Source: DEBIAN Type: UNKNOWNDSA-599 Source: DEBIAN Type: DSA-573cupsys -- integer overflows Source: DEBIAN Type: DSA-581xpdf -- integer overflows Source: DEBIAN Type: DSA-599tetex-bin -- integer overflows Source: CCN Type: Xpdf Web siteXpdf Source: CCN Type: GLSA-200410-20Xpdf, CUPS: Multiple integer overflows Source: GENTOO Type: UNKNOWNGLSA-200410-20 Source: CCN Type: GLSA-200410-30GPdf, KPDF, KOffice: Vulnerabilities in included xpdf Source: GENTOO Type: UNKNOWNGLSA-200410-30 Source: CCN Type: GLSA-200411-30pdftohtml: Vulnerabilities in included Xpdf Source: CCN Type: GLSA-200501-31teTeX, pTeX, CSTeX: Multiple vulnerabilities Source: MANDRAKE Type: UNKNOWNMDKSA-2004:113 Source: MANDRAKE Type: UNKNOWNMDKSA-2004:114 Source: MANDRAKE Type: UNKNOWNMDKSA-2004:115 Source: MANDRAKE Type: UNKNOWNMDKSA-2004:116 Source: REDHAT Type: Patch, Vendor AdvisoryRHSA-2004:543 Source: REDHAT Type: UNKNOWNRHSA-2004:592 Source: REDHAT Type: UNKNOWNRHSA-2005:066 Source: REDHAT Type: UNKNOWNRHSA-2005:354 Source: BID Type: Patch, Vendor Advisory11501 Source: CCN Type: BID-11501Xpdf PDFTOPS Multiple Integer Overflow Vulnerabilities Source: CCN Type: USN-14-1xpdf vulnerabilities Source: CCN Type: USN-9-1tetex-bin vulnerabilities Source: FEDORA Type: UNKNOWNFLSA:2353 Source: XF Type: UNKNOWNxpdf-pdf-bo(17818) Source: XF Type: UNKNOWNxpdf-pdf-bo(17818) Source: OVAL Type: UNKNOWNoval:org.mitre.oval:def:9714 Source: SUSE Type: SUSE-SA:2004:038libtiff: local privilege escalation Source: SUSE Type: SUSE-SA:2004:039xpdf gpdf kdegraphics3-pdf pdftohtml cups: remote system compromise Source: SUSE Type: SUSE-SA:2004:040samba: remote denial of service Source: SUSE Type: SUSE-SR:2004:002SUSE Security Summary Report Source: SUSE Type: SUSE-SR:2005:008SUSE Security Summary Report Source: UBUNTU Type: UNKNOWNUSN-9-1 Vulnerable Configuration: Configuration 1 :cpe:/a:easy_software_products:cups:1.0.4:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.0.4_8:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.1:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.4:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.4_2:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.4_3:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.4_5:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.6:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.7:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.10:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.12:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.13:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.14:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.15:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.16:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.17:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.18:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.19:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.19_rc5:*:*:*:*:*:*:* OR cpe:/a:easy_software_products:cups:1.1.20:*:*:*:*:*:*:* OR cpe:/a:gnome:gpdf:0.112:*:*:*:*:*:*:* OR cpe:/a:gnome:gpdf:0.131:*:*:*:*:*:*:* OR cpe:/a:kde:koffice:1.3:*:*:*:*:*:*:* OR cpe:/a:kde:koffice:1.3.1:*:*:*:*:*:*:* OR cpe:/a:kde:koffice:1.3.2:*:*:*:*:*:*:* OR cpe:/a:kde:koffice:1.3.3:*:*:*:*:*:*:* OR cpe:/a:kde:koffice:1.3_beta1:*:*:*:*:*:*:* OR cpe:/a:kde:koffice:1.3_beta2:*:*:*:*:*:*:* OR cpe:/a:kde:koffice:1.3_beta3:*:*:*:*:*:*:* OR cpe:/a:kde:kpdf:3.2:*:*:*:*:*:*:* OR cpe:/a:pdftohtml:pdftohtml:0.32a:*:*:*:*:*:*:* OR cpe:/a:pdftohtml:pdftohtml:0.32b:*:*:*:*:*:*:* OR cpe:/a:pdftohtml:pdftohtml:0.33:*:*:*:*:*:*:* OR cpe:/a:pdftohtml:pdftohtml:0.33a:*:*:*:*:*:*:* OR cpe:/a:pdftohtml:pdftohtml:0.34:*:*:*:*:*:*:* OR cpe:/a:pdftohtml:pdftohtml:0.35:*:*:*:*:*:*:* OR cpe:/a:pdftohtml:pdftohtml:0.36:*:*:*:*:*:*:* OR cpe:/a:tetex:tetex:1.0.7:*:*:*:*:*:*:* OR cpe:/a:tetex:tetex:2.0:*:*:*:*:*:*:* OR cpe:/a:tetex:tetex:2.0.1:*:*:*:*:*:*:* OR cpe:/a:tetex:tetex:2.0.2:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:0.90:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:0.91:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:0.92:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:0.93:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:1.0:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:1.0a:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:1.1:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:2.0:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:2.1:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:2.3:*:*:*:*:*:*:* OR cpe:/a:xpdf:xpdf:3.0:*:*:*:*:*:*:* Configuration 2 :cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:alpha:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:arm:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:hppa:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:ia-32:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:ia-64:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:m68k:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:mips:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:mipsel:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:ppc:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:s-390:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:sparc:*:*:*:*:* OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.2:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.2.1:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.2.2:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.2.3:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.3:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.3.1:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:advanced_server_ia64:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:enterprise_server:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:enterprise_server_ia64:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:workstation:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:workstation_ia64:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3.0:*:advanced_server:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3.0:*:enterprise_server:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3.0:*:workstation_server:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:* OR cpe:/o:redhat:fedora_core:core_2.0:*:*:*:*:*:*:* OR cpe:/o:redhat:linux_advanced_workstation:2.1:*:ia64:*:*:*:*:* OR cpe:/o:redhat:linux_advanced_workstation:2.1:*:itanium_processor:*:*:*:*:* OR cpe:/o:suse:suse_linux:8.0:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:9.0:*:x86_64:*:*:*:*:* OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:* OR cpe:/o:ubuntu:ubuntu_linux:4.1:*:ia64:*:*:*:*:* OR cpe:/o:ubuntu:ubuntu_linux:4.1:*:ppc:*:*:*:*:* Configuration RedHat 1 :cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:easy_software_products:cups:*:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.3.0:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.3.1:*:*:*:*:*:*:* OR cpe:/o:kde:kde:3.2.x:*:*:*:*:*:*:* OR cpe:/a:glyphandcog:xpdfreader:3.00:*:*:*:*:*:*:* OR cpe:/a:glyphandcog:xpdfreader:2.00:*:*:*:*:*:*:* AND cpe:/o:suse:suse_linux:*:*:*:*:*:*:*:* OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:* OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:* OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:* OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:8.2:*:*:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:* OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:* OR cpe:/o:conectiva:linux:9.0:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:* OR cpe:/o:conectiva:linux:10:*:*:*:*:*:*:* OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:* OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:* OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:* OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:* OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:* OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:* Denotes that component is vulnerable Oval Definitions BACK
easy_software_products cups 1.0.4
easy_software_products cups 1.0.4_8
easy_software_products cups 1.1.1
easy_software_products cups 1.1.4
easy_software_products cups 1.1.4_2
easy_software_products cups 1.1.4_3
easy_software_products cups 1.1.4_5
easy_software_products cups 1.1.6
easy_software_products cups 1.1.7
easy_software_products cups 1.1.10
easy_software_products cups 1.1.12
easy_software_products cups 1.1.13
easy_software_products cups 1.1.14
easy_software_products cups 1.1.15
easy_software_products cups 1.1.16
easy_software_products cups 1.1.17
easy_software_products cups 1.1.18
easy_software_products cups 1.1.19
easy_software_products cups 1.1.19_rc5
easy_software_products cups 1.1.20
gnome gpdf 0.112
gnome gpdf 0.131
kde koffice 1.3
kde koffice 1.3.1
kde koffice 1.3.2
kde koffice 1.3.3
kde koffice 1.3_beta1
kde koffice 1.3_beta2
kde koffice 1.3_beta3
kde kpdf 3.2
pdftohtml pdftohtml 0.32a
pdftohtml pdftohtml 0.32b
pdftohtml pdftohtml 0.33
pdftohtml pdftohtml 0.33a
pdftohtml pdftohtml 0.34
pdftohtml pdftohtml 0.35
pdftohtml pdftohtml 0.36
tetex tetex 1.0.7
tetex tetex 2.0
tetex tetex 2.0.1
tetex tetex 2.0.2
xpdf xpdf 0.90
xpdf xpdf 0.91
xpdf xpdf 0.92
xpdf xpdf 0.93
xpdf xpdf 1.0
xpdf xpdf 1.0a
xpdf xpdf 1.1
xpdf xpdf 2.0
xpdf xpdf 2.1
xpdf xpdf 2.3
xpdf xpdf 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
debian debian linux 3.0
gentoo linux *
kde kde 3.2
kde kde 3.2.1
kde kde 3.2.2
kde kde 3.2.3
kde kde 3.3
kde kde 3.3.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 3.0
redhat enterprise linux 3.0
redhat enterprise linux 3.0
redhat enterprise linux desktop 3.0
redhat fedora core core_2.0
redhat linux advanced workstation 2.1
redhat linux advanced workstation 2.1
suse suse linux 8.0
suse suse linux 8.1
suse suse linux 8.2
suse suse linux 9.0
suse suse linux 9.0
suse suse linux 9.1
suse suse linux 9.2
ubuntu ubuntu linux 4.1
ubuntu ubuntu linux 4.1
easy_software_products cups *
kde kde 3.3.0
kde kde 3.3.1
kde kde 3.2.x
foolabs xpdf 3.00
foolabs xpdf 2.00
suse suse linux *
debian debian linux 3.0
gentoo linux *
suse suse linux 8.1
suse linux enterprise server 8
mandrakesoft mandrake multi network firewall 8.2
mandrakesoft mandrake linux corporate server 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
redhat enterprise linux 2.1
suse suse linux 8.2
redhat enterprise linux 2.1
conectiva linux 9.0
suse suse linux 9.0
mandrakesoft mandrake linux 9.2
redhat enterprise linux 3
redhat enterprise linux 3
redhat enterprise linux 3
mandrakesoft mandrake linux 10.0
suse suse linux 9.1
redhat enterprise linux 3
conectiva linux 10
suse suse linux 9.2
mandrakesoft mandrake linux 10.1
mandrakesoft mandrake linux corporate server 3.0
redhat enterprise linux 4
redhat enterprise linux 4
novell linux desktop 9
redhat enterprise linux 4
redhat enterprise linux 4
redhat linux advanced workstation 2.1
suse linux enterprise server 9
mandrakesoft mandrake linux 10.1
mandrakesoft mandrake linux corporate server 3.0
mandrakesoft mandrake linux 9.2
mandrakesoft mandrake linux 10.0
mandrakesoft mandrake linux corporate server 2.1