Vulnerability Name:

CVE-2010-2575 (CCN-61371)

Assigned:2010-08-25
Published:2010-08-25
Updated:2018-10-10
Summary:Heap-based buffer overflow in the RLE decompression functionality in the TranscribePalmImageToJPEG function in generators/plucker/inplug/image.cpp in Okular in KDE SC 4.3.0 through 4.5.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image in a PDB file.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2010-2575

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-13589

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-13629

Source: FEDORA
Type: UNKNOWN
FEDORA-2010-13661

Source: SUSE
Type: UNKNOWN
SUSE-SR:2010:018

Source: CCN
Type: Okular Web site
Okular - more than a reader

Source: CCN
Type: SA40952
KDE Okular PDB Parsing RLE Decompression Buffer Overflow

Source: SECUNIA
Type: Vendor Advisory
40952

Source: SECUNIA
Type: UNKNOWN
41086

Source: SECUNIA
Type: UNKNOWN
41132

Source: CCN
Type: Secunia Research 25/08/2010
KDE Okular PDB Parsing RLE Decompression Buffer Overflow

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2010-109/

Source: SLACKWARE
Type: UNKNOWN
SSA:2010-240-03

Source: CCN
Type: KDE Web site
KDE - Experience Freedom!

Source: CCN
Type: KDE Security Advisory
Okular PDB Processing Memory Corruption Vulnerability

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.kde.org/info/security/advisory-20100825-1.txt

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2010:162

Source: OSVDB
Type: UNKNOWN
67454

Source: CCN
Type: OSVDB ID: 67454
KDE Okular generators/plucker/unpluck/image.cpp TranscribePalmImageToJPEG() Function Overflow

Source: BUGTRAQ
Type: UNKNOWN
20100825 Secunia Research: KDE Okular PDB Parsing RLE Decompression Buffer Overflow

Source: CCN
Type: BID-42702
KDE Okular PDB File Parsing RLE Decompression Buffer Overflow Vulnerability

Source: UBUNTU
Type: UNKNOWN
USN-979-1

Source: VUPEN
Type: Vendor Advisory
ADV-2010-2178

Source: VUPEN
Type: Vendor Advisory
ADV-2010-2179

Source: VUPEN
Type: UNKNOWN
ADV-2010-2202

Source: VUPEN
Type: UNKNOWN
ADV-2010-2206

Source: VUPEN
Type: UNKNOWN
ADV-2010-2219

Source: VUPEN
Type: UNKNOWN
ADV-2010-2230

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=627289

Source: XF
Type: UNKNOWN
okularpdb-imagecpp-bo(61371)

Source: XF
Type: UNKNOWN
okularpdb-imagecpp-bo(61371)

Source: SUSE
Type: SUSE-SR:2010:018
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:kde:kde_sc:4.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:kde:kde_sc:4.5.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20102575
    V
    		CVE-2010-2575
    2022-05-20
    oval:org.opensuse.security:def:33064
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:33015
    P
    		Security update for atftp (Moderate)
    2021-09-27
    oval:org.opensuse.security:def:32183
    P
    		Security update for gtk-vnc (Moderate)
    2021-09-16
    oval:org.opensuse.security:def:29411
    P
    		Security update for cpio (Important)
    2021-08-23
    oval:org.opensuse.security:def:32958
    P
    		Security update for arpwatch (Important)
    2021-06-28
    oval:org.opensuse.security:def:29375
    P
    		Security update for gstreamer-plugins-bad (Important)
    2021-06-07
    oval:org.opensuse.security:def:33103
    P
    		Security update for ovmf (Moderate)
    2021-03-29
    oval:org.opensuse.security:def:32276
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-03-17
    oval:org.opensuse.security:def:28918
    P
    		Security update for java-1_7_1-ibm (Moderate)
    2021-01-04
    oval:org.opensuse.security:def:32564
    P
    		libpython2_6-1_0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33126
    P
    		kdirstat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28029
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:28677
    P
    		Security update for MozillaFirefox
    2020-12-01
    oval:org.opensuse.security:def:28331
    P
    		Security update for php53 (Important)
    2020-12-01
    oval:org.opensuse.security:def:28972
    P
    		Recommended update for python-setuptools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32420
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33463
    P
    		Security update for okular.
    2020-12-01
    oval:org.opensuse.security:def:32658
    P
    		evolution-data-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33170
    P
    		libotr2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28159
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:28693
    P
    		Security update for gd
    2020-12-01
    oval:org.opensuse.security:def:28342
    P
    		Security update for php53 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29021
    P
    		Security update for qemu
    2020-12-01
    oval:org.opensuse.security:def:31963
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32576
    P
    		mailman on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32715
    P
    		libicu-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33808
    P
    		Security update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:28243
    P
    		Security update for libxml2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28737
    P
    		Security update for lcms2
    2020-12-01
    oval:org.opensuse.security:def:28409
    P
    		Security update for tidy (Low)
    2020-12-01
    oval:org.opensuse.security:def:29060
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:31964
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32632
    P
    		apache2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32802
    P
    		vte on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33847
    P
    		Security update for okular
    2020-12-01
    oval:org.opensuse.security:def:28300
    P
    		Security update for netpbm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28540
    P
    		Security update for curl
    2020-12-01
    oval:org.opensuse.security:def:29077
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31975
    P
    		Security update for jasper (Important)
    2020-12-01
    oval:org.opensuse.security:def:32681
    P
    		gvim on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32340
    P
    		Security update for socat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28384
    P
    		Security update for rubygem-activesupport-3_2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28625
    P
    		Security update for Image Magick
    2020-12-01
    oval:org.opensuse.security:def:29121
    P
    		Security update for java-1_7_0-ibm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32049
    P
    		Security update for kvm (Important)
    2020-12-01
    oval:org.opensuse.security:def:32720
    P
    		libnetpbm10 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32341
    P
    		Security update for spice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27953
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:28536
    P
    		Security update for clamav
    2020-12-01
    oval:org.opensuse.security:def:28682
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:29759
    P
    		Security update for ghostscript-library (Important)
    2020-12-01
    oval:org.opensuse.security:def:32742
    P
    		log4net on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32352
    P
    		Security update for squid3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:27954
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28589
    P
    		Security update for mozilla-nspr, mozilla-nss
    2020-12-01
    oval:org.opensuse.security:def:28766
    P
    		Security update for libsndfile
    2020-12-01
    oval:org.opensuse.security:def:29795
    P
    		Security update for okular
    2020-12-01
    oval:org.opensuse.security:def:32786
    P
    		squid3 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32429
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:27965
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28638
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:28330
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32333
    P
    		Security update for samba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33424
    P
    		Security update for PHP5
    2020-12-01
    oval:org.mitre.oval:def:12910
    P
    		USN-979-1 -- kdegraphics vulnerability
    2014-06-30
    BACK
    kde kde sc 4.3.0
    kde kde sc 4.3.1
    kde kde sc 4.3.2
    kde kde sc 4.3.3
    kde kde sc 4.3.4
    kde kde sc 4.3.5
    kde kde sc 4.4.0
    kde kde sc 4.4.1
    kde kde sc 4.4.2
    kde kde sc 4.4.3
    kde kde sc 4.4.4
    kde kde sc 4.4.5
    kde kde sc 4.5.0