Index: vuln.xml =================================================================== RCS file: /home/pcvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.900 diff -u -r1.900 vuln.xml --- vuln.xml 1 Dec 2005 16:08:47 -0000 1.900 +++ vuln.xml 6 Dec 2005 18:15:30 -0000 @@ -34,6 +34,67 @@ --> + + xpdf -- multiple vulnerabilities + + + xpdf + 3.01_1 + + + + +

Secunia reports:

+
+

infamous41md has reported some vulnerabilities in + xpdf, which can be exploited by malicious people to + cause a DoS (Denial of Service) and potentially to + compromise a user's system.

+

1) A boundary error exists in the "DCTStream::readBaselineSOF()" + function in "xpdf/Stream.cc" when copying data from a PDF file + to a heap-based buffer. This can be exploited to cause a + heap-based buffer overflow via a specially crafted PDF file + with an overly large "numComps" value.

+

2) A boundary error exists in the "DCTStream::readProgressiveSOF()" + function in "xpdf/Stream.cc" when copying data from a PDF + file to a heap-based buffer. This can be exploited to cause + a heap-based buffer overflow via a specially crafted PDF + file with an overly large "numComps" value.

+

3) An error exists in the "StreamPredictor::StreamPredictor()" + function in "xpdf/Stream.cc" when using the "numComps" value + to calculate the memory size to be allocated by "gmalloc()". + This can be exploited to cause "gmalloc()" to allocate less + memory than required, which will lead to a heap-based buffer + overflow when data is copied from the PDF file to the allocated + memory.

+

4) An error exists in the "JPXStream::readCodestream()" + function in "xpdf/JPXStream.cc" when using the "nXTiles" + and "nYTiles" values from a PDF file to copy data from the + file into allocated memory. This can be exploited to cause + a heap-based buffer overflow via a specially crafted PDF file + with overly large "nXTiles" and "nYTiles" values.

+

Successful exploitation of the vulnerabilities requires + that the user is e.g. tricked into opening a malicious PDF + file.

+
+ + + + CVE-2005-3191 + CVE-2005-3192 + CVE-2005-3193 + http://secunia.com/advisories/17897/ + http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities + http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities + http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities + http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities + + + 2005-12-05 + 2005-12-06 + + + drupal -- multiple vulnerabilities