CVE-2007-4352
Published: 7 November 2007
Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
Notes
Author | Note |
---|---|
jdstrand | cupsys on Ubuntu is not directly affected as it depends on poppler-utils or xpdf-utils. poppler-utils is in main and gets pulled in on installation of cupsys. koffice fixed in debian 1:1.6.3-4 |
fujitsu | ipe doesn't contain the vulnerable code. |
Priority
Status
Package | Release | Status |
---|---|---|
cups Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
edgy |
Does not exist
|
|
feisty |
Does not exist
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
intrepid |
Not vulnerable
|
|
jaunty |
Not vulnerable
|
|
karmic |
Not vulnerable
|
|
upstream |
Needs triage
|
|
cupsys Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
|
edgy |
Not vulnerable
|
|
feisty |
Not vulnerable
|
|
gutsy |
Not vulnerable
|
|
hardy |
Not vulnerable
|
|
intrepid |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
upstream |
Needs triage
|
|
gpdf Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
edgy |
Ignored
(end of life, was needed)
|
|
feisty |
Does not exist
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
intrepid |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
upstream |
Needs triage
|
|
ipe Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
|
edgy |
Not vulnerable
|
|
feisty |
Not vulnerable
|
|
gutsy |
Not vulnerable
|
|
hardy |
Not vulnerable
|
|
intrepid |
Not vulnerable
|
|
jaunty |
Not vulnerable
|
|
karmic |
Not vulnerable
|
|
upstream |
Not vulnerable
|
|
kdegraphics Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
|
edgy |
Not vulnerable
|
|
feisty |
Not vulnerable
|
|
gutsy |
Not vulnerable
|
|
hardy |
Not vulnerable
|
|
intrepid |
Not vulnerable
|
|
jaunty |
Not vulnerable
|
|
karmic |
Not vulnerable
|
|
upstream |
Needs triage
|
|
koffice Launchpad, Ubuntu, Debian |
dapper |
Released
(1:1.5.0-0ubuntu9.3)
|
edgy |
Released
(1:1.5.2-0ubuntu2.3)
|
|
feisty |
Released
(1:1.6.2-0ubuntu1.2)
|
|
gutsy |
Released
(1:1.6.3-0ubuntu5.1)
|
|
hardy |
Released
(1:1.6.3-4)
|
|
intrepid |
Released
(1:1.6.3-4)
|
|
jaunty |
Released
(1:1.6.3-4)
|
|
karmic |
Released
(1:1.6.3-4)
|
|
upstream |
Needed
|
|
libextractor Launchpad, Ubuntu, Debian |
dapper |
Released
(0.5.12-1)
|
edgy |
Released
(0.5.12-1)
|
|
feisty |
Released
(0.5.12-1)
|
|
gutsy |
Released
(0.5.12-1)
|
|
hardy |
Released
(0.5.12-1)
|
|
intrepid |
Released
(0.5.12-1)
|
|
jaunty |
Released
(0.5.12-1)
|
|
karmic |
Released
(0.5.12-1)
|
|
upstream |
Needs triage
|
|
pdfkit.framework Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
edgy |
Ignored
(end of life, was needed)
|
|
feisty |
Ignored
(end of life, was needed)
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
intrepid |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
upstream |
Needs triage
|
|
pdftohtml Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
edgy |
Ignored
(end of life, was needed)
|
|
feisty |
Ignored
(end of life, was needed)
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
intrepid |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
upstream |
Needs triage
|
|
poppler Launchpad, Ubuntu, Debian |
dapper |
Released
(0.5.1-0ubuntu7.3)
|
edgy |
Released
(0.5.4-0ubuntu4.3)
|
|
feisty |
Released
(0.5.4-0ubuntu8.2)
|
|
gutsy |
Released
(0.6-0ubuntu2.1)
|
|
hardy |
Released
(0.6.2-1)
|
|
intrepid |
Released
(0.6.2-1)
|
|
jaunty |
Released
(0.6.2-1)
|
|
karmic |
Released
(0.6.2-1)
|
|
upstream |
Released
(0.6.2)
|
|
tetex-bin Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
(linked to poppler)
|
edgy |
Not vulnerable
(linked to poppler)
|
|
feisty |
Not vulnerable
(linked to poppler)
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
intrepid |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
upstream |
Needs triage
|
|
texlive-bin Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
edgy |
Not vulnerable
(linked to poppler)
|
|
feisty |
Not vulnerable
(linked to poppler)
|
|
gutsy |
Not vulnerable
(linked to poppler)
|
|
hardy |
Not vulnerable
(linked to poppler)
|
|
intrepid |
Not vulnerable
(linked to poppler)
|
|
jaunty |
Not vulnerable
(linked to poppler)
|
|
karmic |
Not vulnerable
(linked to poppler)
|
|
upstream |
Needs triage
|
|
xpdf Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
edgy |
Ignored
(end of life, was needed)
|
|
feisty |
Ignored
(end of life, was needed)
|
|
gutsy |
Released
(3.02-1.2ubuntu1.1)
|
|
hardy |
Not vulnerable
(3.02-1.3ubuntu1)
|
|
intrepid |
Not vulnerable
(3.02-1.3ubuntu1)
|
|
jaunty |
Not vulnerable
(3.02-1.3ubuntu1)
|
|
karmic |
Not vulnerable
(3.02-1.3ubuntu1)
|
|
upstream |
Released
(3.02pl2)
|
|
Patches: other: https://bugs.launchpad.net/ubuntu/+source/xpdf/+bug/129940 debdiff: https://bugs.launchpad.net/ubuntu/+source/xpdf/+bug/160944 |
References
- https://access.redhat.com/errata/RHSA-2007:1026 (poppler)
- https://access.redhat.com/errata/RHSA-2007:1027 (tetex-base)
- https://access.redhat.com/errata/RHSA-2007:1029 (xpdf)
- https://access.redhat.com/errata/RHSA-2007:1025 (gpdf)
- https://ubuntu.com/security/notices/USN-542-1
- https://ubuntu.com/security/notices/USN-542-2
- https://www.cve.org/CVERecord?id=CVE-2007-4352
- NVD
- Launchpad
- Debian