CVE-2005-3191 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2005-3191 Interim 1 4 2023-12-09T02:20:49Z current 2021-05-30T12:33:45Z 2023-12-09T02:20:49Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2005-3191 Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BRY6RHDPEAHDBBB73AHO74DPVUFBVTJP/#BRY6RHDPEAHDBBB73AHO74DPVUFBVTJP E-Mail link for SUSE-SA:2006:001 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/G5ZO4T5OVGGP7R2ULQVUQ3WYM3QLY5VE/#G5ZO4T5OVGGP7R2ULQVUQ3WYM3QLY5VE E-Mail link for SUSE-SR:2005:029 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WVFLUVZS5BGFNCN2FFA2CBJI2ULRFZH6/#WVFLUVZS5BGFNCN2FFA2CBJI2ULRFZH6 E-Mail link for SUSE-SR:2005:030 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YIYSAPQ6TQHXMGLZSNERXHHCQZWXBUYN/#YIYSAPQ6TQHXMGLZSNERXHHCQZWXBUYN E-Mail link for SUSE-SR:2006:001 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PPCCSYGV7S3XUI5X2IOXQCF4LC26BLXY/#PPCCSYGV7S3XUI5X2IOXQCF4LC26BLXY E-Mail link for SUSE-SR:2006:002 https://www.suse.com/support/security/rating/ SUSE Security Ratings Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index. CVE-2005-3191 moderate 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P