Xpdf Buffer Overflows in Processing DCT and JPX Streams May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015309
|
|
SecurityTracker URL: http://securitytracker.com/id?1015309
|
|
CVE Reference: CVE-2005-3191
, CVE-2005-3192
(Links to External Site)
|
Date: Dec 5 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 3.0.1
|
Description: Several vulnerabilities were reported in Xpdf. A remote user may be able to cause arbitrary code to be executed on the target system.
The DCT stream parsing code does not properly validate user-supplied input. The DCTStream::readBaselineSOF() function in 'xpdf/Stream.cc'
does not properly validate the 'numComps' parameter. A remote user can create a specially crafted PDF file that, when processed
by the target user, will trigger an overflow at potentially execute arbitrary code.
The DCTStream::readProgressiveSOF() and StreamPredictor::StreamPredictor()
functions are also affected.
A similar overflow exists in the JPX Stream parsing code used in decoding embedded JPEG 2000 images.
The JPXStream::readCodestream() function in 'xpdf/JPXStream.cc' does not properly validate the 'nXTiles' and 'nYTiles' parameters.
The
vendor was notified on October 13, 2005.
iDEFENSE reported these vulnerabilities.
The original advisories are available at:
http://www.idefense.com/application/p
oi/display?id=342&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=34
4&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities
|
Impact: A remote user can create a specially crafted PDF file that, when processed by the target user, may be able to cause arbitrary code to be executed on the target system with the privileges of the target user.
|
Solution: The vendor has issued a patch, available at:
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch
Also, a fixed version (version 3.01pl1) is available at:
http://www.foolabs.com/xpdf/download.html
|
Vendor URL: www.foolabs.com/xpdf/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Mon, 5 Dec 2005 16:46:10 -0500
Subject: xpdf vulnerabilities
|
http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=345&type=vulnerabilities
CVE-2005-3191
CVE-2005-3192
CVE-2005-3192
|
|
