9.3 - GLSA-200711-22

Executive Summary

Summary
Title	Poppler, KDE: User-assisted execution of arbitrary code

Informations
Name	GLSA-200711-22	First vendor Publication	2007-11-18
Vendor	Gentoo	Last vendor Modification	2007-11-18
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Poppler and various KDE components are vulnerable to multiple memory management issues possibly resulting in the execution of arbitrary code.

Background

Poppler is a cross-platform PDF rendering library originally based on Xpdf. KOffice is an integrated office suite for KDE. KWord is the KOffice word processor. KPDF is a KDE-based PDF viewer included in the kdegraphics package.

Description

Alin Rad Pop (Secunia Research) discovered several vulnerabilities in the "Stream.cc" file of Xpdf: An integer overflow in the DCTStream::reset() method and a boundary error in the CCITTFaxStream::lookChar() method, both leading to heap-based buffer overflows (CVE-2007-5392, CVE-2007-5393). He also discovered a boundary checking error in the DCTStream::readProgressiveDataUnit() method causing memory corruption (CVE-2007-4352). Note: Gentoo's version of Xpdf is patched to use the Poppler library, so the update to Poppler will also fix Xpdf.

Impact

By enticing a user to view or process a specially crafted PDF file with KWord or KPDF or a Poppler-based program such as Gentoo's viewers Xpdf, ePDFView, and Evince or the CUPS printing system, a remote attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All Poppler users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/poppler-0.6.1-r1"

All KPDF users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kpdf-3.5.7-r3"

All KDE Graphics Libraries users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.5.7-r3"

All KWord users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-office/kword-1.6.3-r2"

All KOffice users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-office/koffice-1.6.3-r2"

References

[ 1 ] CVE-2007-4352 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352
[ 2 ] CVE-2007-5392 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392
[ 3 ] CVE-2007-5393 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200711-22.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200711-22.xml

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10036

Oval ID:	oval:org.mitre.oval:def:10036
Title:	Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.
Description:	Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-5392	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND xpdf is earlier than 0:2.02-11.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics-devel is earlier than 7:3.3.1-6.el4_5 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics is earlier than 7:3.3.1-6.el4_5 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups-libs is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.10 AND gpdf is earlier than 0:2.8.2-7.7.1 AND cups-devel is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.10 AND xpdf is earlier than 1:3.00-14.el4 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND cups-lpd is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND cups-libs is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND cups-devel is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2 AND tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1 AND cups is earlier than 0:1.2.4-11.14.el5_1.3

Definition Id: oval:org.mitre.oval:def:16740

Oval ID:	oval:org.mitre.oval:def:16740
Title:	USN-542-1 -- poppler vulnerabilities
Description:	Secunia Research discovered several vulnerabilities in poppler.
Family:	unix	Class:	patch
Reference(s):	USN-542-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	7
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10	Product(s):	poppler
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND libpoppler1 DPKG is earlier than 0.5.1-0ubuntu7.3 AND Release section Ubuntu 6.10 is installed AND libpoppler1 DPKG is earlier than 0.5.4-0ubuntu4.3 AND Release section Ubuntu 7.04 is installed AND libpoppler1 DPKG is earlier than 0.5.4-0ubuntu8.2 AND Release section Ubuntu 7.10 is installed AND libpoppler2 DPKG is earlier than 0.6-0ubuntu2.1

Definition Id: oval:org.mitre.oval:def:17520

Oval ID:	oval:org.mitre.oval:def:17520
Title:	USN-542-2 -- koffice vulnerabilities
Description:	USN-542-1 fixed a vulnerability in poppler.
Family:	unix	Class:	patch
Reference(s):	USN-542-2 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10	Product(s):	koffice
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND kword DPKG is earlier than 1:1.5.0-0ubuntu9.3 AND Release section Ubuntu 6.10 is installed AND kword DPKG is earlier than 1:1.5.2-0ubuntu2.3 AND Release section Ubuntu 7.04 is installed AND kword DPKG is earlier than 1:1.6.2-0ubuntu1.2 AND Release section Ubuntu 7.10 is installed AND kword DPKG is earlier than 1:1.6.3-0ubuntu5.1

Definition Id: oval:org.mitre.oval:def:18361

Oval ID:	oval:org.mitre.oval:def:18361
Title:	DSA-1537-1 xpdf
Description:	Alin Rad Pop (Secunia) discovered a number of vulnerabilities in xpdf, a set of tools for display and conversion of Portable Document Format (PDF) files.
Family:	unix	Class:	patch
Reference(s):	DSA-1537-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	xpdf
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND xpdf DPKG is earlier than 3.01-9.1+etch2

Definition Id: oval:org.mitre.oval:def:18702

Oval ID:	oval:org.mitre.oval:def:18702
Title:	DSA-1509-1 koffice - multiple vulnerabilities
Description:	Several vulnerabilities have been discovered in xpdf code that is embedded in koffice, an integrated office suite for KDE. These flaws could allow an attacker to execute arbitrary code by inducing the user to import a specially crafted PDF document.
Family:	unix	Class:	patch
Reference(s):	DSA-1509-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	koffice
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND koffice DPKG is earlier than 1:1.6.1-2etch2

Definition Id: oval:org.mitre.oval:def:20193

Oval ID:	oval:org.mitre.oval:def:20193
Title:	DSA-1480-1 poppler - several vulnerabilities
Description:	Alin Rad Pop discovered several buffer overflows in the Poppler PDF library, which could allow the execution of arbitrary code if a malformed PDF file is opened.
Family:	unix	Class:	patch
Reference(s):	DSA-1480-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	poppler
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND poppler DPKG is earlier than 0:0.4.5-5.1etch2

Definition Id: oval:org.mitre.oval:def:20264

Oval ID:	oval:org.mitre.oval:def:20264
Title:	DSA-1408-1 kdegraphics - buffer overflow with arbitrary code execution
Description:	Alin Rad Pop discovered a buffer overflow in kpdf, which could allow the execution of arbitrary code if a malformed PDF file is displayed.
Family:	unix	Class:	patch
Reference(s):	DSA-1408-1 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	kdegraphics
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND kdegraphics DPKG is earlier than 4:3.5.5-3etch2

Definition Id: oval:org.mitre.oval:def:22588

Oval ID:	oval:org.mitre.oval:def:22588
Title:	ELSA-2007:1027: tetex security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1027-02 CVE-2007-4033 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	21
Platform(s):	Oracle Linux 5	Product(s):	tetex
Definition Synopsis:
Oracle Linux 5.x rpm test tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2

Definition Id: oval:org.mitre.oval:def:22617

Oval ID:	oval:org.mitre.oval:def:22617
Title:	ELSA-2007:1021: cups security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1021-01 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	cups
Definition Synopsis:
Oracle Linux 5.x rpm test cups-lpd is earlier than 1:1.2.4-11.14.el5_1.3 AND cups-devel is earlier than 1:1.2.4-11.14.el5_1.3 AND cups-libs is earlier than 1:1.2.4-11.14.el5_1.3 AND cups is earlier than 1:1.2.4-11.14.el5_1.3

Definition Id: oval:org.mitre.oval:def:22638

Oval ID:	oval:org.mitre.oval:def:22638
Title:	ELSA-2007:1026: poppler security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1026-01 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	poppler
Definition Synopsis:
Oracle Linux 5.x rpm test poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1

Definition Id: oval:org.mitre.oval:def:22644

Oval ID:	oval:org.mitre.oval:def:22644
Title:	ELSA-2007:1051: kdegraphics security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1051-04 CVE-2007-5393	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	kdegraphics
Definition Synopsis:
Oracle Linux 5.x rpm test kdegraphics is earlier than 7:3.5.4-5.el5_1 AND kdegraphics-devel is earlier than 7:3.5.4-5.el5_1

Definition Id: oval:org.mitre.oval:def:7107

Oval ID:	oval:org.mitre.oval:def:7107
Title:	DSA-1480 poppler -- several vulnerabilities
Description:	Alin Rad Pop discovered several buffer overflows in the Poppler PDF library, which could allow the execution of arbitrary code if a malformed PDF file is opened. The old stable distribution (sarge) doesn't contain poppler.
Family:	unix	Class:	patch
Reference(s):	DSA-1480 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	poppler
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is mipsel AND Installed architecture is arm Packages section poppler-utils is earlier than 0.4.5-5.1etch2 AND libpoppler0c2 is earlier than 0.4.5-5.1etch2 AND libpoppler-dev is earlier than 0.4.5-5.1etch2 AND libpoppler-qt-dev is earlier than 0.4.5-5.1etch2 AND libpoppler0c2-glib is earlier than 0.4.5-5.1etch2 AND libpoppler-glib-dev is earlier than 0.4.5-5.1etch2 AND libpoppler0c2-qt is earlier than 0.4.5-5.1etch2

Definition Id: oval:org.mitre.oval:def:7858

Oval ID:	oval:org.mitre.oval:def:7858
Title:	DSA-1509 koffice -- multiple vulnerabilities
Description:	Several vulnerabilities have been discovered in xpdf code that is embedded in koffice, an integrated office suite for KDE. These flaws could allow an attacker to execute arbitrary code by inducing the user to import a specially crafted PDF document. The Common Vulnerabilities and Exposures project identifies the following problems: Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file. Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow. Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter. Updates for the old stable distribution (sarge) will be made available as soon as possible.
Family:	unix	Class:	patch
Reference(s):	DSA-1509 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	koffice
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section krita-data is earlier than 1:1.6.1-2etch2 AND koffice-doc is earlier than 1:1.6.1-2etch2 AND koffice is earlier than 1:1.6.1-2etch2 AND koffice-doc-html is earlier than 1:1.6.1-2etch2 AND kivio-data is earlier than 1:1.6.1-2etch2 AND koffice-data is earlier than 1:1.6.1-2etch2 AND kword-data is earlier than 1:1.6.1-2etch2 AND kpresenter-data is earlier than 1:1.6.1-2etch2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is alpha AND Installed architecture is mips AND Installed architecture is hppa AND Packages section kpresenter is earlier than 1:1.6.1-2etch2 AND kivio is earlier than 1:1.6.1-2etch2 AND koffice-dbg is earlier than 1:1.6.1-2etch2 AND koffice-dev is earlier than 1:1.6.1-2etch2 AND kugar is earlier than 1:1.6.1-2etch2 AND krita is earlier than 1:1.6.1-2etch2 AND kplato is earlier than 1:1.6.1-2etch2 AND kformula is earlier than 1:1.6.1-2etch2 AND kchart is earlier than 1:1.6.1-2etch2 AND koffice-libs is earlier than 1:1.6.1-2etch2 AND karbon is earlier than 1:1.6.1-2etch2 AND koshell is earlier than 1:1.6.1-2etch2 AND kspread is earlier than 1:1.6.1-2etch2 AND kthesaurus is earlier than 1:1.6.1-2etch2 AND kexi is earlier than 1:1.6.1-2etch2 AND kword is earlier than 1:1.6.1-2etch2

Definition Id: oval:org.mitre.oval:def:7985

Oval ID:	oval:org.mitre.oval:def:7985
Title:	DSA-1537 xpdf -- several vulnerabilities
Description:	Alin Rad Pop (Secunia) discovered a number of vulnerabilities in xpdf, a set of tools for display and conversion of Portable Document Format (PDF) files. The Common Vulnerabilities and Exposures project identifies the following three problems: Inadequate DCT stream validation allows an attacker to corrupt memory and potentially execute arbitrary code by supplying a maliciously crafted PDF file. An integer overflow vulnerability in DCT stream handling could allow an attacker to overflow a heap buffer, enabling the execution of arbitrary code. A buffer overflow vulnerability in xpdf's CCITT image compression handlers allows overflow on the heap, allowing an attacker to execute arbitrary code by supplying a maliciously crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	DSA-1537 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	xpdf
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section xpdf-common is earlier than 3.01-9.1+etch2 AND xpdf is earlier than 3.01-9.1+etch2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is mips AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section xpdf-utils is earlier than 3.01-9.1+etch2 AND xpdf-reader is earlier than 3.01-9.1+etch2

Definition Id: oval:org.mitre.oval:def:9839

Oval ID:	oval:org.mitre.oval:def:9839
Title:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-5393	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section tetex-latex is earlier than 0:1.0.7-67.11 AND tetex-dvips is earlier than 0:1.0.7-67.11 AND tetex-fonts is earlier than 0:1.0.7-67.11 AND cups-libs is earlier than 0:1.1.17-13.3.46 AND tetex is earlier than 0:1.0.7-67.11 AND cups-devel is earlier than 0:1.1.17-13.3.46 AND tetex-afm is earlier than 0:1.0.7-67.11 AND xpdf is earlier than 0:2.02-11.el3 AND tetex-xdvi is earlier than 0:1.0.7-67.11 AND cups is earlier than 0:1.1.17-13.3.46 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics-devel is earlier than 7:3.3.1-6.el4_5 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics is earlier than 7:3.3.1-6.el4_5 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups-libs is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.10 AND gpdf is earlier than 0:2.8.2-7.7.1 AND cups-devel is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.10 AND xpdf is earlier than 1:3.00-14.el4 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section kdegraphics-devel is earlier than 7:3.5.4-5.el5_1 AND cups-lpd is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND kdegraphics is earlier than 7:3.5.4-5.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND cups-libs is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1 AND tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND cups-devel is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2 AND tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND cups is earlier than 0:1.2.4-11.14.el5_1.3

Definition Id: oval:org.mitre.oval:def:9979

Oval ID:	oval:org.mitre.oval:def:9979
Title:	Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
Description:	Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-4352	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND xpdf is earlier than 0:2.02-11.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics-devel is earlier than 7:3.3.1-6.el4_5 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics is earlier than 7:3.3.1-6.el4_5 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups-libs is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.10 AND gpdf is earlier than 0:2.8.2-7.7.1 AND cups-devel is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.10 AND xpdf is earlier than 1:3.00-14.el4 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND cups-lpd is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND cups-libs is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND cups-devel is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2 AND tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1 AND cups is earlier than 0:1.2.4-11.14.el5_1.3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Xpdf cpe:2.3:a:xpdf:xpdf:3.02p11:::::::* cpe:2.3:a:xpdf:xpdf:3.0.1_pl1:::::::*	2

OpenVAS Exploits

Date	Description
2009-10-13	Name : SLES10: Security update for xpdf File : nvt/sles10_xpdf1.nasl
2009-10-13	Name : SLES10: Security update for kdegraphics3-pdf File : nvt/sles10_kdegraphics3-pd.nasl
2009-10-10	Name : SLES9: Security update for Cups File : nvt/sles9p5016608.nasl
2009-04-09	Name : Mandriva Update for xpdf MDKSA-2007:219 (xpdf) File : nvt/gb_mandriva_MDKSA_2007_219.nasl
2009-04-09	Name : Mandriva Update for kdegraphics MDKSA-2007:221 (kdegraphics) File : nvt/gb_mandriva_MDKSA_2007_221.nasl
2009-04-09	Name : Mandriva Update for koffice MDKSA-2007:222 (koffice) File : nvt/gb_mandriva_MDKSA_2007_222.nasl
2009-04-09	Name : Mandriva Update for pdftohtml MDKSA-2007:223 (pdftohtml) File : nvt/gb_mandriva_MDKSA_2007_223.nasl
2009-04-09	Name : Mandriva Update for poppler MDKSA-2007:227 (poppler) File : nvt/gb_mandriva_MDKSA_2007_227.nasl
2009-04-09	Name : Mandriva Update for tetex MDKSA-2007:230 (tetex) File : nvt/gb_mandriva_MDKSA_2007_230.nasl
2009-04-09	Name : Mandriva Update for cups MDKSA-2007:228 (cups) File : nvt/gb_mandriva_MDKSA_2007_228.nasl
2009-03-23	Name : Ubuntu Update for poppler vulnerabilities USN-542-1 File : nvt/gb_ubuntu_USN_542_1.nasl
2009-03-23	Name : Ubuntu Update for koffice vulnerabilities USN-542-2 File : nvt/gb_ubuntu_USN_542_2.nasl
2009-02-27	Name : Fedora Update for kdevelop FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdevelop_fc7.nasl
2009-02-27	Name : Fedora Update for kdewebdev FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdewebdev_fc7.nasl
2009-02-27	Name : Fedora Update for kdegraphics FEDORA-2007-3001 File : nvt/gb_fedora_2007_3001_kdegraphics_fc8.nasl
2009-02-27	Name : Fedora Update for xpdf FEDORA-2007-3014 File : nvt/gb_fedora_2007_3014_xpdf_fc8.nasl
2009-02-27	Name : Fedora Update for xpdf FEDORA-2007-3031 File : nvt/gb_fedora_2007_3031_xpdf_fc7.nasl
2009-02-27	Name : Fedora Update for koffice FEDORA-2007-3059 File : nvt/gb_fedora_2007_3059_koffice_fc7.nasl
2009-02-27	Name : Fedora Update for koffice FEDORA-2007-3093 File : nvt/gb_fedora_2007_3093_koffice_fc8.nasl
2009-02-27	Name : Fedora Update for tetex FEDORA-2007-3308 File : nvt/gb_fedora_2007_3308_tetex_fc8.nasl
2009-02-27	Name : Fedora Update for tetex FEDORA-2007-3390 File : nvt/gb_fedora_2007_3390_tetex_fc7.nasl
2009-02-27	Name : Fedora Update for poppler FEDORA-2007-4031 File : nvt/gb_fedora_2007_4031_poppler_fc8.nasl
2009-02-27	Name : Fedora Update for cups FEDORA-2007-746 File : nvt/gb_fedora_2007_746_cups_fc6.nasl
2009-02-27	Name : Fedora Update for tetex FEDORA-2007-750 File : nvt/gb_fedora_2007_750_tetex_fc6.nasl
2009-02-27	Name : Fedora Update for cups FEDORA-2007-3100 File : nvt/gb_fedora_2007_3100_cups_fc7.nasl
2009-02-27	Name : Fedora Update for kdetoys FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdetoys_fc7.nasl
2009-02-27	Name : Fedora Update for kdeutils FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeutils_fc7.nasl
2009-02-27	Name : Fedora Update for kdeartwork FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeartwork_fc7.nasl
2009-02-27	Name : Fedora Update for kdeadmin FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeadmin_fc7.nasl
2009-02-27	Name : Fedora Update for kdeaddons FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeaddons_fc7.nasl
2009-02-27	Name : Fedora Update for kdeaccessibility FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeaccessibility_fc7.nasl
2009-02-27	Name : Fedora Update for kde-i18n FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kde-i18n_fc7.nasl
2009-02-27	Name : Fedora Update for arts FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_arts_fc7.nasl
2009-02-27	Name : Fedora Update for kdebase FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdebase_fc7.nasl
2009-02-27	Name : Fedora Update for kdebindings FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdebindings_fc7.nasl
2009-02-27	Name : Fedora Update for kdeedu FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeedu_fc7.nasl
2009-02-27	Name : Fedora Update for kdegames FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdegames_fc7.nasl
2009-02-27	Name : Fedora Update for kdegraphics FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdegraphics_fc7.nasl
2009-02-27	Name : Fedora Update for cups FEDORA-2007-2982 File : nvt/gb_fedora_2007_2982_cups_fc8.nasl
2009-02-27	Name : Fedora Update for kdelibs FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdelibs_fc7.nasl
2009-02-27	Name : Fedora Update for kdemultimedia FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdemultimedia_fc7.nasl
2009-02-27	Name : Fedora Update for kdenetwork FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdenetwork_fc7.nasl
2009-02-27	Name : Fedora Update for kdepim FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdepim_fc7.nasl
2009-02-27	Name : Fedora Update for kdesdk FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdesdk_fc7.nasl
2009-02-17	Name : Fedora Update for cups FEDORA-2008-3449 File : nvt/gb_fedora_2008_3449_cups_fc7.nasl
2009-02-17	Name : Fedora Update for cups FEDORA-2008-8801 File : nvt/gb_fedora_2008_8801_cups_fc8.nasl
2009-02-17	Name : Fedora Update for poppler FEDORA-2008-3312 File : nvt/gb_fedora_2008_3312_poppler_fc7.nasl
2009-02-17	Name : Fedora Update for cups FEDORA-2008-3586 File : nvt/gb_fedora_2008_3586_cups_fc8.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-2897 File : nvt/gb_fedora_2008_2897_cups_fc7.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-2131 File : nvt/gb_fedora_2008_2131_cups_fc8.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-1976 File : nvt/gb_fedora_2008_1976_cups_fc7.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-1901 File : nvt/gb_fedora_2008_1901_cups_fc8.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-10911 File : nvt/gb_fedora_2008_10911_cups_fc8.nasl
2009-01-28	Name : SuSE Update for xpdf, kdegraphics3-pdf, koffice, libextractor, SUSE-SA:2007:060 File : nvt/gb_suse_2007_060.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200805-13 (ptex) File : nvt/glsa_200805_13.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-34 (cstetex) File : nvt/glsa_200711_34.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-22 (poppler koffice kword kdegraphics kpdf) File : nvt/glsa_200711_22.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-26 (tetex) File : nvt/glsa_200711_26.nasl
2008-09-04	Name : FreeBSD Ports: cups-base File : nvt/freebsd_cups-base3.nasl
2008-04-07	Name : Debian Security Advisory DSA 1537-1 (xpdf) File : nvt/deb_1537_1.nasl
2008-02-28	Name : Debian Security Advisory DSA 1509-1 (koffice) File : nvt/deb_1509_1.nasl
2008-02-05	Name : Debian Security Advisory DSA 1480-1 (poppler) File : nvt/deb_1480_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 1408-1 (kdegraphics) File : nvt/deb_1408_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2007-316-01 xpdf/poppler/koffice/kdegraphics File : nvt/esoft_slk_ssa_2007_316_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
39543	Xpdf xpdf/Stream.cc CCITTFaxStream::lookChar Method PDF Handling Overflow
39542	Xpdf xpdf/Stream.cc DCTStream::reset Method PDF Handling Memory Corruption
39541	Xpdf xpdf/Stream.cc DCTStream::readProgressiveDataUnit Method PDF Handling Me...

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1022.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1027.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1028.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-1029.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-1030.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1026.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-1025.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1024.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1023.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071107_cups_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071107_cups_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20071107_gpdf_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071107_poppler_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20071107_xpdf_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071108_tetex_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071112_kdegraphics_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11965.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1022.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1025.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1029.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1051.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1022.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-227.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-222.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-221.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-219.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1023.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1030.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1029.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1028.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1024.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1027.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1025.nasl - Type : ACT_GATHER_INFO
2008-05-13	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200805-13.nasl - Type : ACT_GATHER_INFO
2008-05-11	Name : The remote Fedora host is missing a security update. File : fedora_2008-3586.nasl - Type : ACT_GATHER_INFO
2008-05-11	Name : The remote Fedora host is missing a security update. File : fedora_2008-3449.nasl - Type : ACT_GATHER_INFO
2008-04-11	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1537.nasl - Type : ACT_GATHER_INFO
2008-02-26	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1509.nasl - Type : ACT_GATHER_INFO
2008-02-06	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1480.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_xpdf-4644.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_cups-4667.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_kdegraphics3-pdf-4682.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_poppler-4630.nasl - Type : ACT_GATHER_INFO
2007-12-11	Name : The remote Fedora host is missing a security update. File : fedora_2007-4031.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Fedora host is missing a security update. File : fedora_2007-3308.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-230.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Fedora host is missing a security update. File : fedora_2007-3390.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Fedora Core host is missing a security update. File : fedora_2007-750.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-34.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1408.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-228.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2007-223.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-26.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-22.nasl - Type : ACT_GATHER_INFO
2007-11-16	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-542-2.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_2747fc39915b11dc9239001c2514716c.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-542-1.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote openSUSE host is missing a security update. File : suse_kdegraphics3-pdf-4681.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote openSUSE host is missing a security update. File : suse_cups-4668.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote Fedora host is missing one or more security updates. File : fedora_2007-2985.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_pdftohtml-4642.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_libextractor-4646.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_koffice-4649.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3031.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3014.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_gpdf-4651.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3001.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-316-01.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3059.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_poppler-4638.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1024.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_xpdf-4643.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3093.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3100.nasl - Type : ACT_GATHER_INFO
2007-11-09	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1027.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1030.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Fedora host is missing a security update. File : fedora_2007-2982.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1021.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1023.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1026.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1028.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1031.nasl - Type : ACT_GATHER_INFO
2007-08-15	Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2007-160.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:35:19	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	16
CPE ID(s)	2
osvdb(s)	3
Openvas Exploit(s)	64
Nessus® Exploit(s)	83

	Related
9.3	VU#907481
9.3	GLSA-200805-13
9.3	GLSA-200711-34
9.3	CVE-2007-5393
9.3	CVE-2007-5392
7.6	CVE-2007-4352
6.8	GLSA-200711-26
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 7 more Alert(s)

9.3 - GLSA-200711-22

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU