• info
• discussion
• exploit
• solution
• references

XPDF DCTStream Progressive Remote Heap Buffer Overflow Vulnerability

Solution:
The vendor has released a patch to address this issue. Please see the referenced advisories for more information.


Sun Solaris 10.0

• Sun 120739-04
  SPARC Platform
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -120739-04-1

Xpdf Xpdf 0.93

• Xpdf xpdf-3.01pl1.patch
  ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch

Xpdf Xpdf 1.0 1

• Mandriva xpdf-1.01-4.10.C21mdk.i586.rpm
  Corporate Server 2.1:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva xpdf-1.01-4.10.C21mdk.x86_64.rpm
  Corporate Server 2.1/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Xpdf xpdf-3.01pl1.patch
  ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch

Xpdf Xpdf 1.0 0

• RedHat xpdf-1.00-7.6.legacy.i386.rpm
  Red Hat Linux 7.3:
  http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-1.00-7.6 .legacy.i386.rpm


• RedHat xpdf-chinese-simplified-1.00-7.6.legacy.i386.rpm
  Red Hat Linux 7.3:
  http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-chinese- simplified-1.00-7.6.legacy.i386.rpm


• RedHat xpdf-chinese-traditional-1.00-7.6.legacy.i386.rpm
  Red Hat Linux 7.3:
  http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-chinese- traditional-1.00-7.6.legacy.i386.rpm


• RedHat xpdf-japanese-1.00-7.6.legacy.i386.rpm
  Red Hat Linux 7.3:
  http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-japanese -1.00-7.6.legacy.i386.rpm


• RedHat xpdf-korean-1.00-7.6.legacy.i386.rpm
  Red Hat Linux 7.3:
  http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-korean-1 .00-7.6.legacy.i386.rpm


• Xpdf xpdf-3.01pl1.patch
  ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch

KDE KOffice 1.3 beta1

• KDE post-1.3-koffice-CAN-2005-3193.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-1.3-koffice-CAN-2005-3 193.diff

KDE KOffice 1.3 beta2

• KDE post-1.3-koffice-CAN-2005-3193.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-1.3-koffice-CAN-2005-3 193.diff

KDE KOffice 1.3.3

• KDE post-1.3-koffice-CAN-2005-3193.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-1.3-koffice-CAN-2005-3 193.diff

KDE KOffice 1.3.5

• koffice-doc-html_1.3.5-2ubuntu1.2_all.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/universe/k/koffice/koffice-doc- html_1.3.5-2ubuntu1.2_all.deb


• KDE post-1.3-koffice-CAN-2005-3193.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-1.3-koffice-CAN-2005-3 193.diff

KDE KOffice 1.4

• KDE post-1.3-koffice-CAN-2005-3193.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-1.3-koffice-CAN-2005-3 193.diff

Xpdf Xpdf 3.0 1

• Mandriva xpdf-3.01-1.1.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva xpdf-3.01-1.1.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Slackware xpdf-3.01-i486-3.tgz
  Slackware 10.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ xpdf-3.01-i486-3.tgz


• Slackware xpdf-3.01-i486-3.tgz
  Slackware 10.2:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ xpdf-3.01-i486-3.tgz


• Slackware xpdf-3.01-i486-3.tgz
  Slackware 9.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/x pdf-3.01-i486-3.tgz


• Slackware xpdf-3.01-i486-3a.tgz
  Slackware 10.1:ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/xpdf-3.01-i486-3a.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ xpdf-3.01-i486-3a.tgz


• Xpdf xpdf-3.01pl1.patch
  ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch

Xpdf Xpdf 3.0 pl2

• Xpdf xpdf-3.01pl1.patch
  ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch

Xpdf Xpdf 3.0 pl3

• Xpdf xpdf-3.01pl1.patch
  ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch

KDE KDE 3.2.3

• Conectiva kamera-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kamera-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kcoloredit-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kcoloredit-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kdegraphics-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kdegraphics-common-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kdegraphics-devel-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kdegraphics-doc-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kdvi-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kdvi-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kfax-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kgamma-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kgamma-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kghostview-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kghostview-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kiconedit-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kiconedit-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kmrml-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kolourpaint-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kolourpaint-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kooka-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kooka-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kpdf-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kpdf-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kpovmodeler-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kpovmodeler-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kruler-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kruler-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva ksnapshot-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva ksnapshot-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva ksvg-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kuickshow-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kview-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva kview-help-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• Conectiva libkmultipage0-3.3.2-62084U10_7cl.i386.rpm
  Version 10:
  ftp://atualizacoes.conectiva.com.br/10/RPMS/xpdf-3.01-48231U10_7cl.i38 6.rpm


• KDE post-3.2.3-kdegraphics-CAN-2005-3193.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-3.2.3-kdegraphics-CAN- 2005-3193.diff

KDE KDE 3.3.2

• KDE post-3.3.2-kdegraphics-CAN-2005-3193.diff
  ftp://ftp.kde.org/pub/kde/security_patches/post-3.3.2-kdegraphics-CAN- 2005-3193.diff