A number of vulnerabilities have been found in the xpdf code used by cups which could be exploited, potentially remotely, by tricking the user to print a specially crafted PDF file.

The vulnerabilities are in the source code file Stream.cc and may allow execution of arbitrary code with the privileges of the user viewing the PDF. Specifically, these are an array indexing error leading to memory corruption (CVE-2007-4352), a possible integer overflow causing to a buffer overflow (CVE-2007-5392) and a boundary check error that can also cause a buffer overflow. (CVE-2007-5393)

New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current. New poppler packages are available for Slackware 12.0 and -current. New koffice packages are available for Slackware 11.0, 12.0, and -current. New kdegraphics packages are available for Slackware 10.2, 11.0, 12.0, and -current. These updated packages address similar bugs which could be used to crash applications linked with poppler or that use code from xpdf through the use of a malformed PDF document. It is possible that a maliciously crafted document could cause code to be executed in the context of the user running the application processing the PDF. These advisories and CVE entries cover the bugs:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.kde.org/info/security/advisory-20071107-1.txt

A flaw in the t1lib library where an attacker could create a malicious file that would cause tetex to crash or possibly execute arbitrary code when opened (CVE-2007-4033).

Alin Rad Pop found several flaws in how PDF files are handled in tetex. An attacker could create a malicious PDF file that would cause tetex to crash or potentially execute arbitrary code when opened (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393).

A stack-based buffer overflow in dvips in tetex allows for user-assisted attackers to execute arbitrary code via a DVI file with a long href tag (CVE-2007-5935).

A vulnerability in dvips in tetex allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place (CVE-2007-5936).

Multiple buffer overflows in dviljk in tetext may allow users-assisted attackers to execute arbitrary code via a crafted DVI input file (CVE-2007-5937).

The updated packages have been patched to correct this issue.

Updated CUPS packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated tetex packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (dvi) file as output.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause TeTeX to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4033)

Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

A buffer overflow in the xpdf code contained in kpdf could be exploited by attackers to potentially execute arbitrary code.
(CVE-2007-4352 / CVE-2007-5392 / CVE-2007-5393)

- fix t1lib flaw CVE-2007-4033 (#352271)

    - fix CVE-2007-4352 CVE-2007-5392 CVE-2007-5393, various       xpdf flaws (#345121)

    - xdvi won't segfault if DVI file contains character       which is not present in font (#243630)

  - fix dvips -z buffer overflow with long href     CVE-2007-5935 (#368591)

    - fix insecure usage of temporary file in dviljk       CVE-2007-5936 CVE-2007-5937 (#368611, #368641)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in the xpdf code contained in gpdf could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393).

A buffer overflow in the xpdf code contained in koffice could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393).

A buffer overflow in the xpdf code contained in pdftohtml could be exploited by attackers to potentially execute arbitrary code (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393).

Updated kdegraphics packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment. This includes kpdf, a PDF file viewer.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

All kdegraphics users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Several vulnerabilities have been discovered in xpdf code that is embedded in koffice, an integrated office suite for KDE. These flaws could allow an attacker to execute arbitrary code by inducing the user to import a specially crafted PDF document. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-4352     Array index error in the     DCTStream::readProgressiveDataUnit method in     xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler,     teTeX, KDE, KOffice, CUPS, and other products, allows     remote attackers to trigger memory corruption and     execute arbitrary code via a crafted PDF file.

  - CVE-2007-5392     Integer overflow in the DCTStream::reset method in     xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers     to execute arbitrary code via a crafted PDF file,     resulting in a heap-based buffer overflow.

  - CVE-2007-5393     Heap-based buffer overflow in the     CCITTFaxStream::lookChar method in xpdf/Stream.cc in     Xpdf 3.02p11 allows remote attackers to execute     arbitrary code via a PDF file that contains a crafted     CCITTFaxDecode filter.

Updates for the old stable distribution (sarge) will be made available as soon as possible.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause an application linked with poppler to crash, or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-1026 advisory.

    [2.3.27-8.1]      Fixes for:
     - 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit()
     - 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset()
     - 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar()

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
41166	SuSE9 Security Update : Cups (YOU Patch Number 11965)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
28149	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 9.1 / current : xpdf/poppler/koffice/kdegraphics (SSA:2007-316-01)	Nessus	Slackware Local Security Checks	2007/11/12	2021/1/14	high
28324	Mandrake Linux Security Advisory : tetex (MDKSA-2007:230)	Nessus	Mandriva Local Security Checks	2007/11/26	2021/1/6	high
27835	RHEL 5 : cups (RHSA-2007:1021)	Nessus	Red Hat Local Security Checks	2007/11/8	2021/1/14	high
27852	RHEL 4 / 5 : tetex (RHSA-2007:1027)	Nessus	Red Hat Local Security Checks	2007/11/9	2021/1/14	high
29481	SuSE 10 Security Update : kdegraphics3-pdf (ZYPP Patch Number 4682)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high
28307	Fedora 7 : tetex-3.0-40.3.fc7 (2007-3390)	Nessus	Fedora Local Security Checks	2007/11/26	2021/1/11	high
28170	openSUSE 10 Security Update : gpdf (gpdf-4651)	Nessus	SuSE Local Security Checks	2007/11/12	2021/1/14	high
28173	openSUSE 10 Security Update : koffice (koffice-4649)	Nessus	SuSE Local Security Checks	2007/11/12	2021/1/14	high
28177	openSUSE 10 Security Update : pdftohtml (pdftohtml-4642)	Nessus	SuSE Local Security Checks	2007/11/12	2021/1/14	high
37318	CentOS 4 : kdegraphics (CESA-2007:1024)	Nessus	CentOS Local Security Checks	2009/4/23	2021/1/4	high
31170	Debian DSA-1509-1 : koffice - multiple vulnerabilities	Nessus	Debian Local Security Checks	2008/2/26	2021/1/4	high
60290	Scientific Linux Security Update : poppler on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
60300	Scientific Linux Security Update : kdegraphics on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
67603	Oracle Linux 5 : Important: / poppler (ELSA-2007-1026)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high