Vulnerability Name:

CVE-2005-3192 (CCN-23442)

Assigned:2005-12-06
Published:2005-12-06
Updated:2018-10-19
Summary:Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: CONFIRM
Type: Patch
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch

Source: SCO
Type: UNKNOWN
SCOSA-2006.15

Source: SCO
Type: UNKNOWN
SCOSA-2006.20

Source: SCO
Type: UNKNOWN
SCOSA-2006.21

Source: SGI
Type: UNKNOWN
20051201-01-U

Source: SGI
Type: UNKNOWN
20060101-01-U

Source: SGI
Type: UNKNOWN
20060201-01-U

Source: MISC
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289

Source: MITRE
Type: CNA
CVE-2005-3192

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:001

Source: CCN
Type: RHSA-2005-840
xpdf security update

Source: CCN
Type: RHSA-2005-867
gpdf security update

Source: CCN
Type: RHSA-2005-868
kdegraphics security update

Source: REDHAT
Type: Vendor Advisory
RHSA-2005:868

Source: CCN
Type: RHSA-2005-878
cups security update

Source: CCN
Type: RHSA-2006-0160
tetex security update

Source: CCN
Type: Chris Evans Security Advisory CESA-2005-003 - rev 2
xpdf (and derivatives) buffer and integer overflows

Source: MISC
Type: UNKNOWN
http://scary.beasts.org/security/CESA-2005-003.txt

Source: CCN
Type: SA17897
Xpdf Multiple Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
17897

Source: CCN
Type: SA17908
KOffice KWord PDF Filter Xpdf Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
17908

Source: CCN
Type: SA17912
Poppler Xpdf Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
17912

Source: CCN
Type: SA17916
teTeX Xpdf Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
17916

Source: CCN
Type: SA17920
KDE kpdf Xpdf Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
17920

Source: CCN
Type: SA17921
pdftohtml Xpdf Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
17921

Source: SECUNIA
Type: Vendor Advisory
17926

Source: SECUNIA
Type: Vendor Advisory
17929

Source: CCN
Type: SA17940
GNOME gpdf Xpdf Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
17940

Source: SECUNIA
Type: UNKNOWN
17955

Source: CCN
Type: SA17976
CUPS xpdf Multiple Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
17976

Source: SECUNIA
Type: Vendor Advisory
18009

Source: SECUNIA
Type: Vendor Advisory
18055

Source: SECUNIA
Type: Vendor Advisory
18061

Source: SECUNIA
Type: Vendor Advisory
18189

Source: SECUNIA
Type: Vendor Advisory
18191

Source: SECUNIA
Type: Vendor Advisory
18192

Source: CCN
Type: SA18303
xpdf Multiple Integer Overflow Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
18303

Source: SECUNIA
Type: Vendor Advisory
18313

Source: SECUNIA
Type: Vendor Advisory
18336

Source: SECUNIA
Type: Vendor Advisory
18349

Source: SECUNIA
Type: UNKNOWN
18380

Source: SECUNIA
Type: UNKNOWN
18385

Source: SECUNIA
Type: Vendor Advisory
18387

Source: SECUNIA
Type: Vendor Advisory
18389

Source: CCN
Type: SA18398
libextractor Multiple Xpdf Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
18398

Source: SECUNIA
Type: UNKNOWN
18407

Source: SECUNIA
Type: Vendor Advisory
18416

Source: SECUNIA
Type: UNKNOWN
18428

Source: SECUNIA
Type: UNKNOWN
18436

Source: SECUNIA
Type: Vendor Advisory
18448

Source: SECUNIA
Type: UNKNOWN
18503

Source: SECUNIA
Type: UNKNOWN
18517

Source: SECUNIA
Type: UNKNOWN
18534

Source: SECUNIA
Type: UNKNOWN
18549

Source: SECUNIA
Type: UNKNOWN
18554

Source: SECUNIA
Type: UNKNOWN
18582

Source: CCN
Type: SA18674
GNUStep PDFKit Framework Xpdf Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
18674

Source: SECUNIA
Type: UNKNOWN
18675

Source: SECUNIA
Type: UNKNOWN
18679

Source: SECUNIA
Type: UNKNOWN
18908

Source: SECUNIA
Type: UNKNOWN
18913

Source: SECUNIA
Type: UNKNOWN
19230

Source: SECUNIA
Type: UNKNOWN
19377

Source: SECUNIA
Type: UNKNOWN
19797

Source: SECUNIA
Type: UNKNOWN
19798

Source: CCN
Type: SA25729
Sun Solaris Gnome PDF Viewer Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
25729

Source: SECUNIA
Type: UNKNOWN
26413

Source: SREASON
Type: UNKNOWN
235

Source: SREASON
Type: UNKNOWN
240

Source: CCN
Type: SECTRACK ID: 1015309
Xpdf Buffer Overflows in Processing DCT and JPX Streams May Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1015309

Source: CCN
Type: SECTRACK ID: 1015324
KDE KOffice kpdf Buffer Overflows in Processing DCT and JPX Streams May Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1015324

Source: SLACKWARE
Type: UNKNOWN
SSA:2006-045-09

Source: SLACKWARE
Type: UNKNOWN
SSA:2006-045-04

Source: CCN
Type: Sun Alert ID: 102972
Multiple Security Vulnerabilities in the Solaris Gnome PDF Viewer (gpdf(1)) may Allow a Denial of Service (DoS) Condition or Lead to Execution of Arbitrary Code

Source: SUNALERT
Type: UNKNOWN
102972

Source: CCN
Type: ASA-2006-007
cups security update (RHSA-2005-878)

Source: CCN
Type: ASA-2006-019
tetex security update (RHSA-2006-0160)

Source: CCN
Type: ASA-2006-094
UnixWare CUPS Multiple Buffer Overflow Vulnerabilities (SCOSA-2006.21)

Source: CCN
Type: ASA-2007-281
Multiple Security Vulnerabilities in the Solaris Gnome PDF Viewer (gpdf(1)) may Allow a Denial of Service (DoS) Condition or Lead to Execution of Arbitrary Code (SUN 102972)

Source: DEBIAN
Type: UNKNOWN
DSA-931

Source: DEBIAN
Type: UNKNOWN
DSA-932

Source: DEBIAN
Type: UNKNOWN
DSA-936

Source: DEBIAN
Type: UNKNOWN
DSA-937

Source: DEBIAN
Type: UNKNOWN
DSA-950

Source: DEBIAN
Type: UNKNOWN
DSA-961

Source: DEBIAN
Type: UNKNOWN
DSA-962

Source: DEBIAN
Type: DSA-931
xpdf -- buffer overflows

Source: DEBIAN
Type: DSA-932
kdegraphics -- buffer overflows

Source: DEBIAN
Type: DSA-936
libextractor -- buffer overflows

Source: DEBIAN
Type: DSA-937
tetex-bin -- buffer overflows

Source: DEBIAN
Type: DSA-940
gpdf -- buffer overflows

Source: DEBIAN
Type: DSA-950
cupsys -- buffer overflows

Source: DEBIAN
Type: DSA-961
pdfkit.framework -- buffer overflows

Source: DEBIAN
Type: DSA-962
pdftohtml -- buffer overflows

Source: CCN
Type: Xpdf Web site
Xpdf: Download

Source: CCN
Type: GLSA-200512-08
Xpdf, GPdf, CUPS, Poppler: Multiple vulnerabilities

Source: GENTOO
Type: UNKNOWN
GLSA-200512-08

Source: CCN
Type: GLSA-200601-02
KPdf, KWord: Multiple overflows in included Xpdf code

Source: GENTOO
Type: UNKNOWN
GLSA-200601-02

Source: CCN
Type: iDEFENSE Security Advisory 12.05.05
Multiple Vendor xpdf StreamPredictor Heap Overflow Vulnerability

Source: IDEFENSE
Type: Patch, Vendor Advisory
20051205 Multiple Vendor xpdf StreamPredictor Heap Overflow Vulnerability

Source: CONFIRM
Type: UNKNOWN
http://www.kde.org/info/security/advisory-20051207-1.txt

Source: CCN
Type: KDE Security Advisory 20051207-2
kpdf/xpdf multiple integer overflows

Source: CONFIRM
Type: UNKNOWN
http://www.kde.org/info/security/advisory-20051207-2.txt

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:003

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:004

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:005

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:006

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:008

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2006:010

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:011

Source: SUSE
Type: UNKNOWN
SUSE-SR:2005:029

Source: SUSE
Type: UNKNOWN
SUSE-SR:2006:002

Source: FEDORA
Type: UNKNOWN
FEDORA-2005-1126

Source: FEDORA
Type: UNKNOWN
FEDORA-2005-1127

Source: CCN
Type: Fedora Update Notification FEDORA-2005-1141
Fedora Core 3 Update: cups-1.1.22-0.rc1.8.8

Source: FEDORA
Type: UNKNOWN
FEDORA-2005-1141

Source: CCN
Type: Fedora Update Notification FEDORA-2005-1142
Fedora Core 4 Update: cups-1.1.23-15.2

Source: FEDORA
Type: UNKNOWN
FEDORA-2005-1142

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2005:840

Source: REDHAT
Type: Vendor Advisory
RHSA-2005:867

Source: REDHAT
Type: Vendor Advisory
RHSA-2005:878

Source: REDHAT
Type: UNKNOWN
RHSA-2006:0160

Source: BUGTRAQ
Type: UNKNOWN
20051207 [KDE Security Advisory] multiple buffer overflows in kpdf/koffice

Source: FEDORA
Type: UNKNOWN
FLSA-2006:176751

Source: FEDORA
Type: UNKNOWN
FLSA:175404

Source: BID
Type: Patch
15725

Source: CCN
Type: BID-15725
XPDF StreamPredictor Remote Heap Buffer Overflow Vulnerability

Source: TRUSTIX
Type: UNKNOWN
TSLSA-2005-0072

Source: CCN
Type: TLSA-2006-2
Multiple vulnerabilities exist in cups

Source: CCN
Type: USN-227-1
xpdf vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-227-1

Source: VUPEN
Type: UNKNOWN
ADV-2005-2755

Source: VUPEN
Type: UNKNOWN
ADV-2005-2786

Source: VUPEN
Type: UNKNOWN
ADV-2005-2787

Source: VUPEN
Type: UNKNOWN
ADV-2005-2788

Source: VUPEN
Type: UNKNOWN
ADV-2005-2789

Source: VUPEN
Type: UNKNOWN
ADV-2005-2790

Source: VUPEN
Type: UNKNOWN
ADV-2005-2856

Source: VUPEN
Type: UNKNOWN
ADV-2007-2280

Source: XF
Type: UNKNOWN
xpdf-streampredictor-bo(23442)

Source: XF
Type: UNKNOWN
xpdf-streampredictor-bo(23442)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-1609

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10914

Source: SUSE
Type: SUSE-SA:2006:001
xpdf various security problems

Source: SUSE
Type: SUSE-SR:2005:029
SUSE Security Summary Report

Source: SUSE
Type: SUSE-SR:2005:030
SUSE Security Summary Report

Source: SUSE
Type: SUSE-SR:2006:001
SUSE Security Summary Report

Source: SUSE
Type: SUSE-SR:2006:002
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:xpdf:xpdf:3.0.1:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:glyphandcog:xpdfreader:3.01:*:*:*:*:*:*:*
  • OR cpe:/o:kde:kde:3.5:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*
  • OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:10.0::oss:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:fuji:*:*:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:personal:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:multimedia:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20053192
    V
    		CVE-2005-3192
    2015-11-16
    oval:org.mitre.oval:def:10914
    V
    		Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.
    2013-04-29
    oval:com.redhat.rhsa:def:20060160
    P
    		RHSA-2006:0160: tetex security update (Moderate)
    2008-03-20
    oval:com.redhat.rhsa:def:20050868
    P
    		RHSA-2005:868: kdegraphics security update (Important)
    2008-03-20
    oval:org.debian:def:961
    V
    		buffer overflows
    2006-02-01
    oval:org.debian:def:962
    V
    		buffer overflows
    2006-02-01
    oval:org.debian:def:950
    V
    		buffer overflows
    2006-01-23
    oval:org.debian:def:940
    V
    		buffer overflows
    2006-01-13
    oval:org.debian:def:937
    V
    		buffer overflows
    2006-01-12
    oval:org.debian:def:936
    V
    		buffer overflows
    2006-01-11
    oval:org.debian:def:931
    V
    		buffer overflows
    2006-01-09
    oval:org.debian:def:932
    V
    		buffer overflows
    2006-01-09
    oval:com.redhat.rhsa:def:20050840
    P
    		RHSA-2005:840: xpdf security update (Important)
    2005-12-20
    oval:com.redhat.rhsa:def:20050867
    P
    		RHSA-2005:867: gpdf security update (Important)
    2005-12-20
    oval:com.redhat.rhsa:def:20050878
    P
    		RHSA-2005:878: cups security update (Important)
    2005-12-20
    BACK
    xpdf xpdf 3.0.1
    foolabs xpdf 3.01
    kde kde 3.5
    debian debian linux 3.0
    gentoo linux *
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    suse suse linux 9.0
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    suse suse linux 9.1
    redhat enterprise linux 3
    suse suse linux 9.2
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    debian debian linux 3.1
    sun solaris 10
    sun solaris 10
    suse suse linux 10.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux corporate server 3.0
    turbolinux turbolinux fuji
    turbolinux turbolinux personal *
    turbolinux turbolinux home *
    turbolinux turbolinux multimedia *
    mandrakesoft mandrake linux corporate server 2.1
    suse suse linux 9.3