Unscored severity · published Dec 31, 2005
CVE-2005-3625
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams…
–
CVSS
3.8%
EPSS
No
On KEV
Description
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cups · Easy Software Products
1.1.22; 1.1.22_rc1; 1.1.23; 1.1.23_rc1 · source: NVD
DL
Debian Linux · Debian
3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +19 more · source: NVD
EL
Enterprise Linux · Redhat
2.1; 2.1; 2.1; 2.1; 2.1; 2.1; +6 more · source: NVD
EL
Enterprise Linux Desktop · Redhat
3.0; 4.0 · source: NVD
FC
Fedora Core · Redhat
core_1.0; core_2.0; core_3.0; core_4.0 · source: NVD
KD
Kdegraphics · Kde
3.2; 3.4.3 · source: NVD
KO
Koffice · Kde
1.4; 1.4.1; 1.4.2 · source: NVD
KP
Kpdf · Kde
3.2; 3.4.3 · source: NVD
KW
Kword · Kde
1.4.2 · source: NVD
LI
Libextractor · Libextractor
All versions, or not specified · source: NVD
LI
Linux · Redhat
7.3; 9.0 · source: NVD
LA
Linux Advanced Workstation · Redhat
2.1; 2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3625
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3625
Patch
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html
Patch
http://rhn.redhat.com/errata/RHSA-2006-0177.html
More from Linux
9.8
CVE-2002-0083
Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges
–
CVE-2005-3626
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted…
–
CVE-2005-3624
The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via…
–
CVE-2005-0207
Unknown vulnerability in Linux kernel 2.4.x, 2.5.x, and 2.6.x allows NFS clients to cause a denial of service via O_DIRECT
–
CVE-2005-0754
Kommander in KDE 3.2 through KDE 3.4.0 executes data files without confirmation from the user, which allows remote attackers to execute arbitrary code