CVE-2005-2097 xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which...
LowCVSS 2.1
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| KDE kpdf | All versions | No fix listed |
| xpdf | = 3.0 | No fix listed |
| xpdf | = 3.0_pl2 | No fix listed |
| xpdf | = 3.0_pl3 | No fix listed |
| debian/cups(Debian:12) | < 1.1.22-7 | 1.1.22-7 |
| debian/cups(Debian:13) | < 1.1.22-7 | 1.1.22-7 |
| debian/cups(Debian:14) | < 1.1.22-7 | 1.1.22-7 |
| debian/libextractor(Debian:12) | < 0.5.8-1 | 0.5.8-1 |
| debian/libextractor(Debian:13) | < 0.5.8-1 | 0.5.8-1 |
| debian/libextractor(Debian:14) | < 0.5.8-1 | 0.5.8-1 |
| debian/poppler(Debian:12) | < 0.4.0-1 | 0.4.0-1 |
| debian/poppler(Debian:13) | < 0.4.0-1 | 0.4.0-1 |
| debian/poppler(Debian:14) | < 0.4.0-1 | 0.4.0-1 |
| debian/xpdf(Debian:12) | < 3.00-15 | 3.00-15 |
| debian/xpdf(Debian:13) | < 3.00-15 | 3.00-15 |
| debian/xpdf(Debian:14) | < 3.00-15 | 3.00-15 |
References
- 17277 third-party-advisory vendor-advisory
- 18398 third-party-advisory vendor-advisory
- 18407 third-party-advisory vendor-advisory
- 21339 third-party-advisory
- 25729 third-party-advisory
- 102972 vendor-advisory
- DSA-780 vendor-advisory
- DSA-1136 vendor-advisory
- DSA-936 vendor-advisory
- MDKSA-2005:138 vendor-advisory
- SUSE-SR:2005:019 vendor-advisory
- RHSA-2005:670 vendor-advisory
- RHSA-2005:671 vendor-advisory
- RHSA-2005:706 vendor-advisory
- RHSA-2005:708 vendor-advisory
- FLSA-2006:176751 vendor-advisory
- FLSA:175404 vendor-advisory
- 14529 vdb-entry
- ADV-2007-2280 vdb-entry
- oval:org.mitre.oval:def:10280 signature vdb-entry
- USN-163-1 vendor-advisory
- Debian Security Tracker CVE-2005-2097 vendor-advisory
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking