Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.52946
Category:Turbolinux Local Security Tests
Title:Turbolinux TLSA-2003-39 (xpdf)
Summary:NOSUMMARY
Description:Description:

The remote host is missing an update to xpdf
announced via advisory TLSA-2003-39.

Xpdf is an X Window System based viewer for Portable Document Format (PDF) files.
If a victim clicks on a hyperlink contained within a malicious PDF file,
an attacker may be able to execute arbitrary commands with the privileges of the victim.
The remote attacker may be able to execute the arbitrary commands
because xpdf spawn external programs to handle hyperlinks by invoking
the shell command interpreter.

An attacker can embed malicious external-type hyperlinks that if activated or
followed by a victim can execute arbitrary shell commands.

Solution: Please use the turbopkg (zabom) tool to apply the update.
http://www.securityspace.com/smysecure/catid.html?in=TLSA-2003-39

Risk factor : High

CVSS Score:
7.5

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2003-0434
Bugtraq: 20030709 xpdf vulnerability - CAN-2003-0434 (Google Search)
http://marc.info/?l=bugtraq&m=105777963019186&w=2
CERT/CC vulnerability note: VU#200132
http://www.kb.cert.org/vuls/id/200132
http://lists.grok.org.uk/pipermail/full-disclosure/2003-June/005719.html
http://www.mandriva.com/security/advisories?name=MDKSA-2003:071
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A664
http://www.redhat.com/support/errata/RHSA-2003-196.html
http://www.redhat.com/support/errata/RHSA-2003-197.html
http://secunia.com/advisories/9037
http://secunia.com/advisories/9038
CopyrightCopyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.