CVE-2005-3628 Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers....
HighCVSS 7.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xpdf | All versions | No fix listed |
| debian/cups(Debian:12) | < 1.1.22-7 | 1.1.22-7 |
| debian/cups(Debian:13) | < 1.1.22-7 | 1.1.22-7 |
| debian/cups(Debian:14) | < 1.1.22-7 | 1.1.22-7 |
| debian/libextractor(Debian:12) | < 0.5.9-1 | 0.5.9-1 |
| debian/libextractor(Debian:13) | < 0.5.9-1 | 0.5.9-1 |
| debian/libextractor(Debian:14) | < 0.5.9-1 | 0.5.9-1 |
| debian/xpdf(Debian:12) | < 3.01-4 | 3.01-4 |
| debian/xpdf(Debian:13) | < 3.01-4 | 3.01-4 |
| debian/xpdf(Debian:14) | < 3.01-4 | 3.01-4 |
References
- SUSE-SA:2006:001 patch vendor-advisory
- 18147 third-party-advisory
- 18380 third-party-advisory
- 18385 patch third-party-advisory vendor-advisory
- 18387 patch third-party-advisory vendor-advisory
- 18389 patch third-party-advisory vendor-advisory
- 18398 patch third-party-advisory vendor-advisory
- 18407 patch third-party-advisory vendor-advisory
- 18416 patch third-party-advisory vendor-advisory
- 18428 third-party-advisory
- 18436 third-party-advisory
- 18534 patch third-party-advisory vendor-advisory
- 18582 patch third-party-advisory vendor-advisory
- 18674 third-party-advisory
- 18675 third-party-advisory
- 18679 third-party-advisory
- 18908 third-party-advisory
- 18913 third-party-advisory
- 19230 third-party-advisory
- SSA:2006-045-09 vendor-advisory
- SSA:2006-045-04 vendor-advisory
- DSA-931 vendor-advisory
- DSA-932 vendor-advisory
- DSA-937 vendor-advisory
- DSA-938 vendor-advisory
- DSA-940 vendor-advisory
- DSA-936 patch vendor-advisory
- DSA-950 patch vendor-advisory
- DSA-961 vendor-advisory
- DSA-962 vendor-advisory
- MDKSA-2006:010 vendor-advisory
- MDKSA-2006:011 vendor-advisory
- MDKSA-2006:012 vendor-advisory
- RHSA-2006:0160 patch vendor-advisory
- FLSA-2006:176751 vendor-advisory
- FLSA:175404 vendor-advisory
- oval:org.mitre.oval:def:10287 signature vdb-entry
- Debian Security Tracker CVE-2005-3628 vendor-advisory