xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.

'infamous41md' and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, which is also present in libextractor, a library to extract arbitrary meta-data from files, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code.

'infamous41md' and Chris Evans discovered several heap based buffer overflows in xpdf, the Portable Document Format (PDF) suite, which are also present in gpdf, the viewer with Gtk bindings, and which can lead to a denial of service by crashing the application or possibly to the execution of arbitrary code.

An updated gpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gpdf package is an GNOME based viewer for Portable Document Format (PDF) files.

Marcus Meissner reported a flaw in gpdf. An attacker could construct a carefully crafted PDF file that would cause gpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Note that this issue does not affect the version of gpdf in Red Hat Enterprise Linux 3 or 2.1.

Users of gpdf should upgrade to this updated package, which contains a backported patch to resolve this issue.

Updated kdegraphics packages that resolve a security issue in kpdf are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a pdf file viewer.

A flaw was discovered in kpdf. An attacker could construct a carefully crafted PDF file that would cause kpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Note this issue does not affect Red Hat Enterprise Linux 3 or 2.1.

Users of kpdf should upgrade to these updated packages, which contains a backported patch to resolve this issue.

An updated xpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The xpdf package is an X Window System-based viewer for Portable Document Format (PDF) files.

A flaw was discovered in Xpdf in that an attacker could construct a carefully crafted PDF file that would cause Xpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Note this issue does not affect the version of Xpdf in Red Hat Enterprise Linux 3 or 2.1.

Users of xpdf should upgrade to this updated package, which contains a backported patch to resolve this issue.

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

When processing a PDF file, bounds checking was not correctly performed on some fields. This could cause the pdftops filter (running as user 'lp') to crash. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2097 to this issue.

All users of CUPS should upgrade to these erratum packages, which contain a patch to correct this issue.

xpdf is vulnerable to a denial of service vulnerability which can cause xpdf to create an infinitely large file, thereby filling up the /tmp partition, when opening a specially crafted PDF file.

Note that several applications contains an embedded version of xpdf, therefor making them the vulnerable to the same DoS. In CUPS this vulnerability would cause the pdftops filter to crash.

xpdf and kpdf did not sufficiently verify the validity of the 'loca' table in PDF files, a table that contains glyph description information for embedded TrueType fonts. After detecting the broken table, xpdf attempted to reconstruct the information in it, which caused the generation of a huge temporary file that quickly filled up available disk space and rendered the application unresponsive.

The CUPS printing system in Ubuntu 5.04 uses the xpdf-utils package to convert PDF files to PostScript. By attempting to print such a crafted PDF file, a remote attacker could cause a Denial of Service in a print server. The CUPS system in Ubuntu 4.10 is not vulnerable against this attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered in the CUPS printing package where when processing a PDF file, bounds checking was not correctly performed on some fields. As a result, this could cause the pdtops filter to crash.

Update :

The patch to correct this problem was not properly applied to the Mandriva 10.1 packages. This update properly patches the packages.

A vulnerability in the xpdf PDF viewer was discovered. An attacker could construct a malicious PDF file that would cause xpdf to consume all available disk space in /tmp when opened.

The updated packages have been patched to correct this problem.

A bug has been discovered in the font handling code in xpdf, which is also present in kpdf, the PDF viewer for KDE. A specially crafted PDF file could cause infinite resource consumption, in terms of both CPU and disk space.

The oldstable distribution (woody) is not affected by this problem.

The remote host is affected by the vulnerability described in GLSA-200508-08 (Xpdf, Kpdf, GPdf: Denial of Service vulnerability)

    Xpdf, Kpdf and GPdf do not handle a broken table of embedded     TrueType fonts correctly. After detecting such a table, Xpdf, Kpdf and     GPdf attempt to reconstruct the information in it by decoding the PDF     file, which causes the generation of a huge temporary file.
  Impact :

    A remote attacker may cause a Denial of Service by creating a     specially crafted PDF file, sending it to a CUPS printing system (which     uses Xpdf), or by enticing a user to open it in Xpdf, Kpdf, or GPdf.
  Workaround :

    There is no known workaround at this time.

A flaw was discovered in Xpdf in that an attacker could construct a carefully crafted PDF file that would cause Xpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Users of xpdf should upgrade to this updated package, which contains a backported patch to resolve this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in Xpdf in that an attacker could construct a carefully crafted PDF file that would cause Xpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Users of xpdf should upgrade to this updated package, which contains a patch to resolve this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:708 advisory.

    The gpdf package is an GNOME based viewer for Portable Document Format     (PDF) files.

    Marcus Meissner reported a flaw in gpdf.  An attacker could construct a     carefully crafted PDF file that would cause gpdf to consume all available     disk space in /tmp when opened. The Common Vulnerabilities and Exposures     project assigned the name CAN-2005-2097 to this issue.

    Note that this issue does not affect the version of gpdf in Red Hat     Enterprise Linux 3 or 2.1.

    Users of gpdf should upgrade to this updated package, which contains a     backported patch to resolve this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:706 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for     UNIX(R) operating systems.

    When processing a PDF file, bounds checking was not correctly performed on     some fields.  This could cause the pdftops filter (running as user lp) to     crash.  The Common Vulnerabilities and Exposures project has assigned the     name CAN-2005-2097 to this issue.

    All users of CUPS should upgrade to these erratum packages, which contain a     patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:671 advisory.

    The kdegraphics packages contain applications for the K Desktop Environment     including kpdf, a pdf file viewer.

    A flaw was discovered in kpdf.  An attacker could construct a carefully     crafted PDF file that would cause kpdf to consume all available disk space     in /tmp when opened. The Common Vulnerabilities and Exposures project     assigned the name CAN-2005-2097 to this issue.

    Note this issue does not affect Red Hat Enterprise Linux 3 or 2.1.

    Users of kpdf should upgrade to these updated packages, which contains a     backported patch to resolve this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:670 advisory.

    The xpdf package is an X Window System-based viewer for Portable Document     Format (PDF) files.

    A flaw was discovered in Xpdf in that an attacker could construct a     carefully crafted PDF file that would cause Xpdf to consume all available     disk space in /tmp when opened. The Common Vulnerabilities and Exposures     project assigned the name CAN-2005-2097 to this issue.

    Note this issue does not affect the version of Xpdf in Red Hat Enterprise     Linux 3 or 2.1.

    Users of xpdf should upgrade to this updated package, which contains a     backported patch to resolve this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
22802	Debian DSA-936-1 : libextractor - buffer overflows	Nessus	Debian Local Security Checks	critical
22678	Debian DSA-1136-1 : gpdf - wrong input sanitising	Nessus	Debian Local Security Checks	low
21957	CentOS 4 : gpdf (CESA-2005:708)	Nessus	CentOS Local Security Checks	low
21956	CentOS 4 : kdegraphics (CESA-2005:671)	Nessus	CentOS Local Security Checks	low
21955	CentOS 4 : xpdf (CESA-2005:670)	Nessus	CentOS Local Security Checks	low
21851	CentOS 3 / 4 : cups (CESA-2005:706)	Nessus	CentOS Local Security Checks	low
21400	FreeBSD : xpdf -- disk fill DoS vulnerability (24eee285-09c7-11da-bc08-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
20569	Ubuntu 4.10 / 5.04 : xpdf vulnerability (USN-163-1)	Nessus	Ubuntu Local Security Checks	low
19895	Mandrake Linux Security Advisory : cups (MDKSA-2005:138-1)	Nessus	Mandriva Local Security Checks	low
19893	Mandrake Linux Security Advisory : xpdf (MDKSA-2005:134)	Nessus	Mandriva Local Security Checks	low
19477	Debian DSA-780-1 : kdegraphics - wrong input sanitising	Nessus	Debian Local Security Checks	low
19441	GLSA-200508-08 : Xpdf, Kpdf, GPdf: Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	low
19435	Fedora Core 3 : xpdf-3.00-10.6.FC3 (2005-730)	Nessus	Fedora Local Security Checks	low
19434	Fedora Core 4 : xpdf-3.00-20.FC4.2 (2005-729)	Nessus	Fedora Local Security Checks	low
19425	RHEL 4 : gpdf (RHSA-2005:708)	Nessus	Red Hat Local Security Checks	medium
19412	RHEL 4 : cups (RHSA-2005:706)	Nessus	Red Hat Local Security Checks	medium
19411	RHEL 4 : kdegraphics (RHSA-2005:671)	Nessus	Red Hat Local Security Checks	medium
19410	RHEL 4 : xpdf (RHSA-2005:670)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2005-2097

medium

Tenable Plugins

critical

low

low

low

low

low

low

low

low

low

low

low

low

low

medium

medium

medium

medium