5 - CVE-2005-3624

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2005-3624	First vendor Publication	2005-12-31
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9437

Oval ID:	oval:org.mitre.oval:def:9437
Title:	The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.
Description:	The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-3624	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section tetex-latex is earlier than 0:1.0.7-67.9 AND tetex-dvips is earlier than 0:1.0.7-67.9 AND tetex-fonts is earlier than 0:1.0.7-67.9 AND cups-libs is earlier than 1:1.1.17-13.3.36 AND tetex is earlier than 0:1.0.7-67.9 AND cups-devel is earlier than 1:1.1.17-13.3.36 AND tetex-afm is earlier than 0:1.0.7-67.9 AND xpdf is earlier than 1:2.02-9.8 AND tetex-xdvi is earlier than 0:1.0.7-67.9 AND cups is earlier than 1:1.1.17-13.3.36 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.EL4.7 AND kdegraphics-devel is earlier than 7:3.3.1-3.6 AND tetex-dvips is earlier than 0:2.0.2-22.EL4.7 AND kdegraphics is earlier than 7:3.3.1-3.6 AND tetex-fonts is earlier than 0:2.0.2-22.EL4.7 AND cups-libs is earlier than 1:1.1.22-0.rc1.9.10 AND tetex is earlier than 0:2.0.2-22.EL4.7 AND gpdf is earlier than 0:2.8.2-7.4 AND cups-devel is earlier than 1:1.1.22-0.rc1.9.10 AND tetex-afm is earlier than 0:2.0.2-22.EL4.7 AND xpdf is earlier than 1:3.00-11.10 AND tetex-xdvi is earlier than 0:2.0.2-22.EL4.7 AND tetex-doc is earlier than 0:2.0.2-22.EL4.7 AND cups is earlier than 1:1.1.22-0.rc1.9.10

CPE : Common Platform Enumeration

Type	Description	Count
Application	Easy Software Products Cups cpe:2.3:a:easy_software_products:cups:1.1.23_rc1:::::::* cpe:2.3:a:easy_software_products:cups:1.1.23:::::::* cpe:2.3:a:easy_software_products:cups:1.1.22_rc1:::::::* cpe:2.3:a:easy_software_products:cups:1.1.22:::::::*	4
Application	Kde Kdegraphics cpe:2.3:a:kde:kdegraphics:3.4.3:::::::* cpe:2.3:a:kde:kdegraphics:3.2:::::::*	2
Application	Kde Koffice cpe:2.3:a:kde:koffice:1.4.2:::::::* cpe:2.3:a:kde:koffice:1.4.1:::::::* cpe:2.3:a:kde:koffice:1.4:::::::*	3
Application	Kde Kpdf cpe:2.3:a:kde:kpdf:3.4.3:::::::* cpe:2.3:a:kde:kpdf:3.2:::::::*	2
Application	Kde Kword cpe:2.3:a:kde:kword:1.4.2:::::::*	1
Application	Libextractor cpe:2.3:a:libextractor:libextractor::::::::	1
Application	Poppler cpe:2.3:a:poppler:poppler:0.4.2:::::::*	1
Application	Sgi Propack cpe:2.3:a:sgi:propack:3.0:sp6::::::	1
Application	Tetex cpe:2.3:a:tetex:tetex:3.0:::::::* cpe:2.3:a:tetex:tetex:2.0.2:::::::* cpe:2.3:a:tetex:tetex:2.0.1:::::::* cpe:2.3:a:tetex:tetex:2.0:::::::* cpe:2.3:a:tetex:tetex:1.0.7:::::::*	5
Application	Xpdf cpe:2.3:a:xpdf:xpdf:3.0:::::::*	1
Os	Conectiva Linux cpe:2.3:o:conectiva:linux:10.0:::::::*	1
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:3.1::ia-64::::: cpe:2.3:o:debian:debian_linux:3.1::s-390::::: cpe:2.3:o:debian:debian_linux:3.1::mipsel::::: cpe:2.3:o:debian:debian_linux:3.1::hppa::::: cpe:2.3:o:debian:debian_linux:3.1::m68k::::: cpe:2.3:o:debian:debian_linux:3.1::alpha::::: cpe:2.3:o:debian:debian_linux:3.1::arm::::: cpe:2.3:o:debian:debian_linux:3.1::sparc::::: cpe:2.3:o:debian:debian_linux:3.1::ppc::::: cpe:2.3:o:debian:debian_linux:3.1::mips::::: cpe:2.3:o:debian:debian_linux:3.1:::::::* cpe:2.3:o:debian:debian_linux:3.1::amd64::::: cpe:2.3:o:debian:debian_linux:3.1::ia-32::::: cpe:2.3:o:debian:debian_linux:3.0::mips::::: cpe:2.3:o:debian:debian_linux:3.0::s-390::::: cpe:2.3:o:debian:debian_linux:3.0::alpha::::: cpe:2.3:o:debian:debian_linux:3.0::mipsel::::: cpe:2.3:o:debian:debian_linux:3.0::hppa::::: cpe:2.3:o:debian:debian_linux:3.0::ia-32::::: cpe:2.3:o:debian:debian_linux:3.0::arm::::: cpe:2.3:o:debian:debian_linux:3.0:::::::* cpe:2.3:o:debian:debian_linux:3.0::ppc::::: cpe:2.3:o:debian:debian_linux:3.0::m68k::::: cpe:2.3:o:debian:debian_linux:3.0::ia-64::::: cpe:2.3:o:debian:debian_linux:3.0::sparc:::::	25
Os	Gentoo Linux cpe:2.3:o:gentoo:linux::::::::	1
Os	Mandrakesoft Mandrake Linux cpe:2.3:o:mandrakesoft:mandrake_linux:2006:::::::* cpe:2.3:o:mandrakesoft:mandrake_linux:2006::x86-64::::: cpe:2.3:o:mandrakesoft:mandrake_linux:10.2:::::::* cpe:2.3:o:mandrakesoft:mandrake_linux:10.2::x86-64::::: cpe:2.3:o:mandrakesoft:mandrake_linux:10.1:::::::* cpe:2.3:o:mandrakesoft:mandrake_linux:10.1::x86-64:::::	6
Os	Mandrakesoft Mandrake Linux Corporate Server cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0:::::::* cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64::::: cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:2.1:::::::* cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:::::	4
Os	Redhat Enterprise Linux cpe:2.3:o:redhat:enterprise_linux:4.0::advanced_server::::: cpe:2.3:o:redhat:enterprise_linux:4.0::enterprise_server::::: cpe:2.3:o:redhat:enterprise_linux:4.0::workstation::::: cpe:2.3:o:redhat:enterprise_linux:3.0::enterprise_server::::: cpe:2.3:o:redhat:enterprise_linux:3.0::workstation_server::::: cpe:2.3:o:redhat:enterprise_linux:3.0::advanced_server::::: cpe:2.3:o:redhat:enterprise_linux:2.1::advanced_server::::: cpe:2.3:o:redhat:enterprise_linux:2.1::workstation::::: cpe:2.3:o:redhat:enterprise_linux:2.1::workstation_ia64::::: cpe:2.3:o:redhat:enterprise_linux:2.1::advanced_server_ia64::::: cpe:2.3:o:redhat:enterprise_linux:2.1::enterprise_server::::: cpe:2.3:o:redhat:enterprise_linux:2.1::enterprise_server_ia64:::::	12
Os	Redhat Enterprise Linux Desktop cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:::::::*	2
Os	Redhat Fedora Core cpe:2.3:o:redhat:fedora_core:core_4.0:::::::* cpe:2.3:o:redhat:fedora_core:core_3.0:::::::* cpe:2.3:o:redhat:fedora_core:core_2.0:::::::* cpe:2.3:o:redhat:fedora_core:core_1.0:::::::*	4
Os	Redhat Linux cpe:2.3:o:redhat:linux:9.0::i386::::: cpe:2.3:o:redhat:linux:7.3::i386:::::	2
Os	Redhat Linux Advanced Workstation cpe:2.3:o:redhat:linux_advanced_workstation:2.1::ia64::::: cpe:2.3:o:redhat:linux_advanced_workstation:2.1::itanium:::::	2
Os	Sco Openserver cpe:2.3:o:sco:openserver:6.0:::::::* cpe:2.3:o:sco:openserver:5.0.7:::::::*	2
Os	Slackware Slackware Linux cpe:2.3:o:slackware:slackware_linux:10.2:::::::* cpe:2.3:o:slackware:slackware_linux:10.1:::::::* cpe:2.3:o:slackware:slackware_linux:10.0:::::::* cpe:2.3:o:slackware:slackware_linux:9.1:::::::* cpe:2.3:o:slackware:slackware_linux:9.0:::::::*	5
Os	Suse Suse Linux cpe:2.3:o:suse:suse_linux:10.0::oss::::: cpe:2.3:o:suse:suse_linux:10.0::professional::::: cpe:2.3:o:suse:suse_linux:9.3::x86_64::::: cpe:2.3:o:suse:suse_linux:9.3::personal::::: cpe:2.3:o:suse:suse_linux:9.3::professional::::: cpe:2.3:o:suse:suse_linux:9.2::professional::::: cpe:2.3:o:suse:suse_linux:9.2::personal::::: cpe:2.3:o:suse:suse_linux:9.2::x86_64::::: cpe:2.3:o:suse:suse_linux:9.1::personal::::: cpe:2.3:o:suse:suse_linux:9.1::professional::::: cpe:2.3:o:suse:suse_linux:9.1::x86_64::::: cpe:2.3:o:suse:suse_linux:9.0::enterprise_server::::: cpe:2.3:o:suse:suse_linux:9.0::x86_64::::: cpe:2.3:o:suse:suse_linux:9.0::personal::::: cpe:2.3:o:suse:suse_linux:9.0::s_390::::: cpe:2.3:o:suse:suse_linux:9.0::professional::::: cpe:2.3:o:suse:suse_linux:1.0:::::::*	17
Os	Trustix Secure Linux cpe:2.3:o:trustix:secure_linux:3.0:::::::* cpe:2.3:o:trustix:secure_linux:2.2:::::::* cpe:2.3:o:trustix:secure_linux:2.0:::::::*	3
Os	Turbolinux cpe:2.3:o:turbolinux:turbolinux:10:::::::* cpe:2.3:o:turbolinux:turbolinux:fuji:::::::*	2
Os	Turbolinux Turbolinux Appliance Server cpe:2.3:o:turbolinux:turbolinux_appliance_server:1.0_workgroup_edition:::::::* cpe:2.3:o:turbolinux:turbolinux_appliance_server:1.0_hosting_edition:::::::*	2
Os	Turbolinux Turbolinux Desktop cpe:2.3:o:turbolinux:turbolinux_desktop:10.0:::::::*	1
Os	Turbolinux Turbolinux Home cpe:2.3:o:turbolinux:turbolinux_home::::::::	1
Os	Turbolinux Turbolinux Multimedia cpe:2.3:o:turbolinux:turbolinux_multimedia::::::::	1
Os	Turbolinux Turbolinux Personal cpe:2.3:o:turbolinux:turbolinux_personal::::::::	1
Os	Turbolinux Turbolinux Server cpe:2.3:o:turbolinux:turbolinux_server:10.0_x86:::::::* cpe:2.3:o:turbolinux:turbolinux_server:10.0:::::::* cpe:2.3:o:turbolinux:turbolinux_server:8.0:::::::*	3
Os	Turbolinux Turbolinux Workstation cpe:2.3:o:turbolinux:turbolinux_workstation:8.0:::::::*	1
Os	Ubuntu Ubuntu Linux cpe:2.3:o:ubuntu:ubuntu_linux:5.10::powerpc::::: cpe:2.3:o:ubuntu:ubuntu_linux:5.10::i386::::: cpe:2.3:o:ubuntu:ubuntu_linux:5.10::amd64::::: cpe:2.3:o:ubuntu:ubuntu_linux:5.04::i386::::: cpe:2.3:o:ubuntu:ubuntu_linux:5.04::amd64::::: cpe:2.3:o:ubuntu:ubuntu_linux:5.04::powerpc::::: cpe:2.3:o:ubuntu:ubuntu_linux:4.1::ia64::::: cpe:2.3:o:ubuntu:ubuntu_linux:4.1::ppc:::::	8

OpenVAS Exploits

Date	Description
2008-09-24	Name : Gentoo Security Advisory GLSA 200601-02 (kdegraphics, kpdf, koffice, kword) File : nvt/glsa_200601_02.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200601-17 (xpdf poppler gpdf libextractor pdfto... File : nvt/glsa_200601_17.nasl
2008-01-17	Name : Debian Security Advisory DSA 1008-1 (kdegraphics) File : nvt/deb_1008_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 931-1 (xpdf) File : nvt/deb_931_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 932-1 (xpdf) File : nvt/deb_932_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 936-1 (libextractor) File : nvt/deb_936_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 937-1 (tetex-bin) File : nvt/deb_937_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 938-1 (koffice) File : nvt/deb_938_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 940-1 (gpdf) File : nvt/deb_940_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 950-1 (cupsys) File : nvt/deb_950_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 961-1 (pdfkit.framework) File : nvt/deb_961_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 962-1 (pdftohtml) File : nvt/deb_962_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2006-045-04 kdegraphics File : nvt/esoft_slk_ssa_2006_045_04.nasl
0000-00-00	Name : Slackware Advisory SSA:2006-045-09 xpdf File : nvt/esoft_slk_ssa_2006_045_09.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
22233	Multiple Products Xpdf/kpdf Stream.cc CCITTFaxStream::CCITTFaxStream Function...

Nessus® Vulnerability Scanner

Date	Description
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-931.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-932.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-936.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-937.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-938.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-940.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-950.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-961.nasl - Type : ACT_GATHER_INFO
2006-10-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-962.nasl - Type : ACT_GATHER_INFO
2006-07-05	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-868.nasl - Type : ACT_GATHER_INFO
2006-07-05	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2006-0177.nasl - Type : ACT_GATHER_INFO
2006-07-03	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2005-840.nasl - Type : ACT_GATHER_INFO
2006-07-03	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0160.nasl - Type : ACT_GATHER_INFO
2006-07-03	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2006-0163.nasl - Type : ACT_GATHER_INFO
2006-02-15	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-045-09.nasl - Type : ACT_GATHER_INFO
2006-02-15	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-045-04.nasl - Type : ACT_GATHER_INFO
2006-02-01	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200601-17.nasl - Type : ACT_GATHER_INFO
2006-01-21	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-236-2.nasl - Type : ACT_GATHER_INFO
2006-01-21	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-236-1.nasl - Type : ACT_GATHER_INFO
2006-01-20	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0160.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Fedora Core host is missing a security update. File : fedora_2006-026.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Fedora Core host is missing a security update. File : fedora_2006-029.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200601-02.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Fedora Core host is missing a security update. File : fedora_2006-025.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-008.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-010.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-011.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-012.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2006-0163.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2006-0177.nasl - Type : ACT_GATHER_INFO
2005-12-30	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-868.nasl - Type : ACT_GATHER_INFO
2005-12-07	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-840.nasl - Type : ACT_GATHER_INFO
2005-01-14	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-026.nasl - Type : ACT_GATHER_INFO
2005-01-14	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-025.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 23:21:13	Multiple Updates
2024-11-28 12:07:38	Multiple Updates
2021-05-04 12:03:18	Multiple Updates
2021-04-22 01:03:35	Multiple Updates
2020-05-23 00:16:58	Multiple Updates
2018-10-19 21:19:40	Multiple Updates
2018-10-04 00:19:25	Multiple Updates
2017-10-11 09:23:35	Multiple Updates
2017-07-11 12:02:03	Multiple Updates
2017-02-19 09:24:41	Multiple Updates
2016-11-19 09:23:43	Multiple Updates
2016-04-26 13:56:39	Multiple Updates
2014-02-17 10:33:31	Multiple Updates
2013-05-11 11:34:20	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	1
CPE ID(s)	127
Sources(s)	82
osvdb(s)	1
Openvas Exploit(s)	14
Nessus® Exploit(s)	34

	Related
10	USN-236-1
10	SUN-102972
10	RHSA-2006:0177
10	RHSA-2006:0163
10	RHSA-2006:0160
10	DSA-962
10	DSA-950
10	DSA-940
10	DSA-938
10	DSA-937
10	DSA-936
10	DSA-932
10	DSA-931
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 13 more Alert(s)