Vulnerability CVE-2006-0301

Vulnerability CVE-2006-0301

Published: 2006-01-30 Modified: 2012-02-12

Description:

Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as (1) poppler, (2) kdegraphics, (3) gpdf, (4) pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed the width or height of the associated bitmap.

See advisories in our WLB2 database:

	Topic	Author	Date
Med.	Heap overflows in included Xpdf code	Thierry Carrez	22.02.2006

Type:

CWE-119

(Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
XPDF -> XPDF

References:

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt

http://rhn.redhat.com/errata/RHSA-2006-0206.html

http://securityreason.com/securityalert/470

http://securitytracker.com/id?1015576

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747

http://www.debian.org/security/2006/dsa-971

http://www.debian.org/security/2006/dsa-972

http://www.debian.org/security/2006/dsa-974

http://www.gentoo.org/security/en/glsa/glsa-200602-04.xml

http://www.gentoo.org/security/en/glsa/glsa-200602-05.xml

http://www.gentoo.org/security/en/glsa/glsa-200602-12.xml

http://www.kde.org/info/security/advisory-20060202-1.txt

http://www.mandriva.com/security/advisories?name=MDKSA-2006:030

http://www.mandriva.com/security/advisories?name=MDKSA-2006:031

http://www.mandriva.com/security/advisories?name=MDKSA-2006:032

http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00039.html

http://www.redhat.com/support/errata/RHSA-2006-0201.html

http://www.securityfocus.com/archive/1/423899/100/0/threaded

http://www.securityfocus.com/archive/1/427990/100/0/threaded

http://www.ubuntu.com/usn/usn-249-1

http://www.vupen.com/english/advisories/2006/0389

http://www.vupen.com/english/advisories/2006/0422

https://bugzilla.novell.com/show_bug.cgi?id=141242

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179046

https://exchange.xforce.ibmcloud.com/vulnerabilities/24391

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10850

Vulnerability CVE-2006-0301

See advisories in our WLB2 database:

Med.

Heap overflows in included Xpdf code

CWE-119

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

7.5/10

6.4/10

10/10

Remote

Low

No required

Partial

Partial

Partial

Affected software

References: