You are viewing this page in an unauthorized frame window.

This is a potential security issue, you are being redirected to https://nvd.nist.gov

You have JavaScript disabled. This site requires JavaScript to be enabled for complete site functionality.

U.S. flag An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

  1. Vulnerabilities

CVE-2005-3192 Detail

Deferred

This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.

Current Description

Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, (6) CUPS, and (7) libextractor allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.


View Analysis Description

Analysis Description

Heap-based buffer overflow in the StreamPredictor function in Xpdf 3.01, as used in products such as (1) Poppler, (2) teTeX, (3) KDE kpdf, and (4) pdftohtml, (5) KOffice KWord, and (6) CUPS allows remote attackers to execute arbitrary code via a PDF file with an out-of-range numComps (number of components) field.

Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NIST CVSS score
NIST: NVD
N/A
NVD assessment not yet provided.
CVSS 3.x Severity and Vector Strings:

NIST CVSS score
NIST: NVD
Base Score: N/A
NVD assessment not yet provided.
CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology
NIST: NVD
Base Score: 7.5 HIGH
Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch CVE, MITRE Patch
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt CVE, MITRE
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt CVE, MITRE
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt CVE, MITRE
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U CVE, MITRE
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U CVE, MITRE
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U CVE, MITRE
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289 CVE, MITRE
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html CVE, MITRE
http://rhn.redhat.com/errata/RHSA-2005-868.html CVE, MITRE Vendor Advisory
http://scary.beasts.org/security/CESA-2005-003.txt CVE, MITRE
http://secunia.com/advisories/17897/ CVE, MITRE Patch Vendor Advisory
http://secunia.com/advisories/17908 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17912 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17916 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17920 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17921 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17926 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17929 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17940 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/17955 CVE, MITRE
http://secunia.com/advisories/17976 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18009 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18055 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18061 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18189 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18191 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18192 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18303 CVE, MITRE
http://secunia.com/advisories/18313 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18336 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18349 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18380 CVE, MITRE
http://secunia.com/advisories/18385 CVE, MITRE
http://secunia.com/advisories/18387 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18389 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18398 CVE, MITRE
http://secunia.com/advisories/18407 CVE, MITRE
http://secunia.com/advisories/18416 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18428 CVE, MITRE
http://secunia.com/advisories/18436 CVE, MITRE
http://secunia.com/advisories/18448 CVE, MITRE Vendor Advisory
http://secunia.com/advisories/18503 CVE, MITRE
http://secunia.com/advisories/18517 CVE, MITRE
http://secunia.com/advisories/18534 CVE, MITRE
http://secunia.com/advisories/18549 CVE, MITRE
http://secunia.com/advisories/18554 CVE, MITRE
http://secunia.com/advisories/18582 CVE, MITRE
http://secunia.com/advisories/18674 CVE, MITRE
http://secunia.com/advisories/18675 CVE, MITRE
http://secunia.com/advisories/18679 CVE, MITRE
http://secunia.com/advisories/18908 CVE, MITRE
http://secunia.com/advisories/18913 CVE, MITRE
http://secunia.com/advisories/19230 CVE, MITRE
http://secunia.com/advisories/19377 CVE, MITRE
http://secunia.com/advisories/19797 CVE, MITRE
http://secunia.com/advisories/19798 CVE, MITRE
http://secunia.com/advisories/25729 CVE, MITRE
http://secunia.com/advisories/26413 CVE, MITRE
http://securityreason.com/securityalert/235 CVE, MITRE
http://securityreason.com/securityalert/240 CVE, MITRE
http://securitytracker.com/id?1015309 CVE, MITRE
http://securitytracker.com/id?1015324 CVE, MITRE
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683 CVE, MITRE
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747 CVE, MITRE
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 CVE, MITRE
http://www.debian.org/security/2005/dsa-931 CVE, MITRE
http://www.debian.org/security/2005/dsa-932 CVE, MITRE
http://www.debian.org/security/2006/dsa-936 CVE, MITRE
http://www.debian.org/security/2006/dsa-937 CVE, MITRE
http://www.debian.org/security/2006/dsa-950 CVE, MITRE
http://www.debian.org/security/2006/dsa-961 CVE, MITRE
http://www.debian.org/security/2006/dsa-962 CVE, MITRE
http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml CVE, MITRE
http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml CVE, MITRE
http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities CVE, MITRE Patch Vendor Advisory
http://www.kde.org/info/security/advisory-20051207-1.txt CVE, MITRE
http://www.kde.org/info/security/advisory-20051207-2.txt CVE, MITRE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:003 CVE, MITRE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:004 CVE, MITRE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:005 CVE, MITRE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:006 CVE, MITRE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:008 CVE, MITRE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 CVE, MITRE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:011 CVE, MITRE
http://www.novell.com/linux/security/advisories/2005_29_sr.html CVE, MITRE
http://www.novell.com/linux/security/advisories/2006_02_sr.html CVE, MITRE
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html CVE, MITRE
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html CVE, MITRE
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00036.html CVE, MITRE
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00037.html CVE, MITRE
http://www.redhat.com/support/errata/RHSA-2005-840.html CVE, MITRE Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-867.html CVE, MITRE Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-878.html CVE, MITRE Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2006-0160.html CVE, MITRE
http://www.securityfocus.com/archive/1/418883/100/0/threaded CVE, MITRE
http://www.securityfocus.com/archive/1/427053/100/0/threaded CVE, MITRE
http://www.securityfocus.com/archive/1/427990/100/0/threaded CVE, MITRE
http://www.securityfocus.com/bid/15725 CVE, MITRE Patch
http://www.trustix.org/errata/2005/0072/ CVE, MITRE
http://www.ubuntulinux.org/usn/usn-227-1 CVE, MITRE
http://www.vupen.com/english/advisories/2005/2755 CVE, MITRE
http://www.vupen.com/english/advisories/2005/2786 CVE, MITRE
http://www.vupen.com/english/advisories/2005/2787 CVE, MITRE
http://www.vupen.com/english/advisories/2005/2788 CVE, MITRE
http://www.vupen.com/english/advisories/2005/2789 CVE, MITRE
http://www.vupen.com/english/advisories/2005/2790 CVE, MITRE
http://www.vupen.com/english/advisories/2005/2856 CVE, MITRE
http://www.vupen.com/english/advisories/2007/2280 CVE, MITRE
https://exchange.xforce.ibmcloud.com/vulnerabilities/23442 CVE, MITRE
https://issues.rpath.com/browse/RPL-1609 CVE, MITRE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10914 CVE, MITRE

Weakness Enumeration

CWE-ID CWE Name Source
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer cwe source acceptance level NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

8 change records found show changes

CVE Modified by CVE 11/20/2024 7:01:19 PM

Action Type Old Value New Value
Added Reference 
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch
Added Reference 
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt
Added Reference 
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt
Added Reference 
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt
Added Reference 
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U
Added Reference 
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
Added Reference 
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U
Added Reference 
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289
Added Reference 
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html
Added Reference 
http://rhn.redhat.com/errata/RHSA-2005-868.html
Added Reference 
http://scary.beasts.org/security/CESA-2005-003.txt
Added Reference 
http://secunia.com/advisories/17897/
Added Reference 
http://secunia.com/advisories/17908
Added Reference 
http://secunia.com/advisories/17912
Added Reference 
http://secunia.com/advisories/17916
Added Reference 
http://secunia.com/advisories/17920
Added Reference 
http://secunia.com/advisories/17921
Added Reference 
http://secunia.com/advisories/17926
Added Reference 
http://secunia.com/advisories/17929
Added Reference 
http://secunia.com/advisories/17940
Added Reference 
http://secunia.com/advisories/17955
Added Reference 
http://secunia.com/advisories/17976
Added Reference 
http://secunia.com/advisories/18009
Added Reference 
http://secunia.com/advisories/18055
Added Reference 
http://secunia.com/advisories/18061
Added Reference 
http://secunia.com/advisories/18189
Added Reference 
http://secunia.com/advisories/18191
Added Reference 
http://secunia.com/advisories/18192
Added Reference 
http://secunia.com/advisories/18303
Added Reference 
http://secunia.com/advisories/18313
Added Reference 
http://secunia.com/advisories/18336
Added Reference 
http://secunia.com/advisories/18349
Added Reference 
http://secunia.com/advisories/18380
Added Reference 
http://secunia.com/advisories/18385
Added Reference 
http://secunia.com/advisories/18387
Added Reference 
http://secunia.com/advisories/18389
Added Reference 
http://secunia.com/advisories/18398
Added Reference 
http://secunia.com/advisories/18407
Added Reference 
http://secunia.com/advisories/18416
Added Reference 
http://secunia.com/advisories/18428
Added Reference 
http://secunia.com/advisories/18436
Added Reference 
http://secunia.com/advisories/18448
Added Reference 
http://secunia.com/advisories/18503
Added Reference 
http://secunia.com/advisories/18517
Added Reference 
http://secunia.com/advisories/18534
Added Reference 
http://secunia.com/advisories/18549
Added Reference 
http://secunia.com/advisories/18554
Added Reference 
http://secunia.com/advisories/18582
Added Reference 
http://secunia.com/advisories/18674
Added Reference 
http://secunia.com/advisories/18675
Added Reference 
http://secunia.com/advisories/18679
Added Reference 
http://secunia.com/advisories/18908
Added Reference 
http://secunia.com/advisories/18913
Added Reference 
http://secunia.com/advisories/19230
Added Reference 
http://secunia.com/advisories/19377
Added Reference 
http://secunia.com/advisories/19797
Added Reference 
http://secunia.com/advisories/19798
Added Reference 
http://secunia.com/advisories/25729
Added Reference 
http://secunia.com/advisories/26413
Added Reference 
http://securityreason.com/securityalert/235
Added Reference 
http://securityreason.com/securityalert/240
Added Reference 
http://securitytracker.com/id?1015309
Added Reference 
http://securitytracker.com/id?1015324
Added Reference 
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683
Added Reference 
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747
Added Reference 
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1
Added Reference 
http://www.debian.org/security/2005/dsa-931
Added Reference 
http://www.debian.org/security/2005/dsa-932
Added Reference 
http://www.debian.org/security/2006/dsa-936
Added Reference 
http://www.debian.org/security/2006/dsa-937
Added Reference 
http://www.debian.org/security/2006/dsa-950
Added Reference 
http://www.debian.org/security/2006/dsa-961
Added Reference 
http://www.debian.org/security/2006/dsa-962
Added Reference 
http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml
Added Reference 
http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml
Added Reference 
http://www.idefense.com/application/poi/display?id=344&type=vulnerabilities
Added Reference 
http://www.kde.org/info/security/advisory-20051207-1.txt
Added Reference 
http://www.kde.org/info/security/advisory-20051207-2.txt
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:003
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:004
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:005
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:006
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:008
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:011
Added Reference 
http://www.novell.com/linux/security/advisories/2005_29_sr.html
Added Reference 
http://www.novell.com/linux/security/advisories/2006_02_sr.html
Added Reference 
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html
Added Reference 
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html
Added Reference 
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00036.html
Added Reference 
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00037.html
Added Reference 
http://www.redhat.com/support/errata/RHSA-2005-840.html
Added Reference 
http://www.redhat.com/support/errata/RHSA-2005-867.html
Added Reference 
http://www.redhat.com/support/errata/RHSA-2005-878.html
Added Reference 
http://www.redhat.com/support/errata/RHSA-2006-0160.html
Added Reference 
http://www.securityfocus.com/archive/1/418883/100/0/threaded
Added Reference 
http://www.securityfocus.com/archive/1/427053/100/0/threaded
Added Reference 
http://www.securityfocus.com/archive/1/427990/100/0/threaded
Added Reference 
http://www.securityfocus.com/bid/15725
Added Reference 
http://www.trustix.org/errata/2005/0072/
Added Reference 
http://www.ubuntulinux.org/usn/usn-227-1
Added Reference 
http://www.vupen.com/english/advisories/2005/2755
Added Reference 
http://www.vupen.com/english/advisories/2005/2786
Added Reference 
http://www.vupen.com/english/advisories/2005/2787
Added Reference 
http://www.vupen.com/english/advisories/2005/2788
Added Reference 
http://www.vupen.com/english/advisories/2005/2789
Added Reference 
http://www.vupen.com/english/advisories/2005/2790
Added Reference 
http://www.vupen.com/english/advisories/2005/2856
Added Reference 
http://www.vupen.com/english/advisories/2007/2280
Added Reference 
https://exchange.xforce.ibmcloud.com/vulnerabilities/23442
Added Reference 
https://issues.rpath.com/browse/RPL-1609
Added Reference 
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10914

CVE Modified by MITRE 5/13/2024 9:31:56 PM

Action Type Old Value New Value

CVE Modified by MITRE 10/19/2018 11:35:12 AM

Action Type Old Value New Value
Added Reference 
http://www.securityfocus.com/archive/1/418883/100/0/threaded [No Types Assigned]
Added Reference 
http://www.securityfocus.com/archive/1/427053/100/0/threaded [No Types Assigned]
Added Reference 
http://www.securityfocus.com/archive/1/427990/100/0/threaded [No Types Assigned]
Removed Reference 
http://www.securityfocus.com/archive/1/archive/1/418883/100/0/threaded [No Types Assigned]
Removed Reference 
http://www.securityfocus.com/archive/1/archive/1/427053/100/0/threaded [No Types Assigned]
Removed Reference 
http://www.securityfocus.com/archive/1/archive/1/427990/100/0/threaded [No Types Assigned]

CVE Modified by MITRE 5/02/2018 9:29:32 PM

Action Type Old Value New Value
Added Reference 
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10914 [No Types Assigned]
Removed Reference 
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10914 [No Types Assigned]

CVE Modified by MITRE 7/10/2017 9:33:07 PM

Action Type Old Value New Value
Added Reference 
https://exchange.xforce.ibmcloud.com/vulnerabilities/23442 [No Types Assigned]
Removed Reference 
http://xforce.iss.net/xforce/xfdb/23442 [Patch]

CVE Modified by MITRE 2/19/2017 12:09:33 AM

Action Type Old Value New Value
Added Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 [No Types Assigned]

CVE Modified by MITRE 11/18/2016 9:59:28 PM

Action Type Old Value New Value
Removed Reference 
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 [No Types Assigned]

Initial CVE Analysis 12/07/2005 9:34:00 PM

Action Type Old Value New Value

Quick Info

CVE Dictionary Entry:
CVE-2005-3192
NVD Published Date:
12/07/2005
NVD Last Modified:
04/02/2025
Source:
MITRE

AltStyle によって変換されたページ (->オリジナル) /