| Description: | Description:
The remote host is missing updates announced in
advisory FLSA-2005:2352.
During a source code audit, Chris Evans and others discovered a number
of integer overflow bugs that affected all versions of xpdf. An attacker
could construct a carefully crafted PDF file that could cause xpdf to
crash or possibly execute arbitrary code when opened. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0888 to this issue.
A buffer overflow flaw was found in the Gfx::doImage function of Xpdf.
An attacker could construct a carefully crafted PDF file that could
cause Xpdf to crash or possibly execute arbitrary code when opened. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-1125 to this issue.
A buffer overflow flaw was found when processing the /Encrypt /Length
tag. An attacker could construct a carefully crafted PDF file that could
cause Xpdf to crash or possibly execute arbitrary code when opened. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2005-0064 to this issue.
Users of xpdf are advised to upgrade to these errata packages, which
contain backported patches correcting these issues.
Affected platforms:
Redhat 7.3
Redhat 9
Fedora Core 1
Solution:
http://www.securityspace.com/smysecure/catid.html?in=FLSA-2005:2352
http://www.idefense.com/application/poi/display?id=186&type=vulnerabilities
Risk factor : Critical
CVSS Score:
10.0
|
