Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature.

Derek Noonburg has fixed several potential vulnerabilities in xpdf, the Portable Document Format (PDF) suite.

The old stable distribution (woody) does not seem to be affected.

Derek Noonburg has fixed several potential vulnerabilities in xpdf, which are also present in pdftohtml, a utility that translates PDF documents into HTML format.

Derek Noonburg has fixed several potential vulnerabilities in xpdf, which are also present in gpdf, the Portable Document Format (PDF) viewer with Gtk bindings.

Derek Noonburg has fixed several potential vulnerabilities in xpdf, the Portable Document Format (PDF) suite, which are also present in pdfkit.framework, the GNUstep framework for rendering PDF content.

Derek Noonburg has fixed several potential vulnerabilities in xpdf, the Portable Document Format (PDF) suite, which is also present in koffice, the KDE Office Suite.

Derek Noonburg discovered several integer overflows in the XPDF code, which is present in xpdf, the Poppler library, and tetex-bin. By tricking an user into opening a specially crafted PDF file, an attacker could exploit this to execute arbitrary code with the privileges of the application that processes the document.

The CUPS printing system also uses XPDF code to convert PDF files to PostScript. By attempting to print such a crafted PDF file, a remote attacker could execute arbitrary code with the privileges of the printer server (user 'cupsys').

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
22850	Debian DSA-984-1 : xpdf - several vulnerabilities	Nessus	Debian Local Security Checks	high
22849	Debian DSA-983-1 : pdftohtml - several vulnerabilities	Nessus	Debian Local Security Checks	high
22848	Debian DSA-982-1 : gpdf - several vulnerabilities	Nessus	Debian Local Security Checks	high
22845	Debian DSA-979-1 : pdfkit.framework - several vulnerabilities	Nessus	Debian Local Security Checks	high
22561	Debian DSA-1019-1 : koffice - several vulnerabilities	Nessus	Debian Local Security Checks	high
21234	Ubuntu 4.10 / 5.04 / 5.10 : kdegraphics, koffice, xpdf, cupsys, poppler, tetex-bin vulnerabilities (USN-270-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2006-1244

high

Tenable Plugins

high

high

high

high

high

high