vulnwire
5.1med

CVE-2005-3191

Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT strea…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
5.1
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.1%
percentile 91%
Public exploits
0
none known

Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.

Exploit prediction (EPSS)

4.08% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.1AV:N/AC:H/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

  • securityreason.com /securityalert/234 · third-party-advisory, x_refsource_SREASON, x_transferred
  • secunia.com /advisories/17929 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/19797 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityreason.com /securityalert/233 · third-party-advisory, x_refsource_SREASON, x_transferred
  • debian.org /security/2005/dsa-932 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/18349 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/18147 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/18055 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • kde.org /info/security/advisory-20051207-1.txt · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/18503 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/18549 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • kde.org /info/security/advisory-20051207-2.txt · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/18679 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/18189 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/26413 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/17940 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9760 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/23444 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/18303 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2005/dsa-931 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/18554 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2006:003 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=342289 · x_refsource_MISC, x_transferred
  • secunia.com /advisories/19230 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-102972-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2006:012 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • debian.org /security/2006/dsa-962 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securitytracker.com /id?1015309 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • debian.org /security/2005/dsa-937 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/18398 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/427053/100/0/threaded · vendor-advisory, x_refsource_FEDORA, x_transferred
  • lists.suse.com /archive/suse-security-announce/2006-Jan/0001.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • debian.org /security/2006/dsa-936 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/17916 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • idefense.com /application/poi/display?id=343&type=vulnerabilities · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • redhat.com /support/errata/RHSA-2005-840.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • vupen.com /english/advisories/2005/2789 · vdb-entry, x_refsource_VUPEN, x_transferred
  • redhat.com /support/errata/RHSA-2005-867.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/18674 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2006:005 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • rhn.redhat.com /errata/RHSA-2005-868.html · Vendor Advisory
  • secunia.com /advisories/17897 · Vendor Advisory
  • secunia.com /advisories/17908 · Vendor Advisory
  • secunia.com /advisories/17912 · Vendor Advisory
  • secunia.com /advisories/17920 · Vendor Advisory
  • secunia.com /advisories/17921 · Vendor Advisory
  • secunia.com /advisories/17926 · Vendor Advisory
  • secunia.com /advisories/17955
  • secunia.com /advisories/17976 · Vendor Advisory
  • secunia.com /advisories/18009 · Vendor Advisory
  • secunia.com /advisories/18061 · Vendor Advisory
  • secunia.com /advisories/18191 · Vendor Advisory
  • secunia.com /advisories/18192 · Vendor Advisory
  • secunia.com /advisories/18313 · Vendor Advisory
  • secunia.com /advisories/18336 · Vendor Advisory
  • secunia.com /advisories/18380
  • secunia.com /advisories/18385 · Vendor Advisory
  • secunia.com /advisories/18387 · Vendor Advisory
  • secunia.com /advisories/18389
  • secunia.com /advisories/18407

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.