MEDIUM
security flaw
Published Dec 7, 2005
5.1
MEDIUMCVSS 2.0
EPSS 4.08%
Description
Multiple heap-based buffer overflows in the (1) DCTStream::readProgressiveSOF and (2) DCTStream::readBaselineSOF functions in the DCT stream parsing code (Stream.cc) in xpdf 3.01 and earlier, as used in products such as (a) Poppler, (b) teTeX, (c) KDE kpdf, (d) pdftohtml, (e) KOffice KWord, (f) CUPS, and (g) libextractor allow user-assisted attackers to cause a denial of service (heap corruption) and possibly execute arbitrary code via a crafted PDF file with an out-of-range number of components (numComps), which is used as an array index.
Affected products
No data.
OR
- 0.90
- 0.91
- 0.92
- 0.93
- 1.0
- 1.0a
- 1.1
- 2.0
- 2.1
- 2.2
- 2.3
- 3.0
- 3.0.1
- 3.0_pl2
- 3.0_pl3
No data.
Red Hat Enterprise Linux 3
cups-1:1.1.17-13.3.34
Fixed · RHSA-2005:878
Red Hat Enterprise Linux 3
tetex-0:1.0.7-67.9
Fixed · RHSA-2006:0160
Red Hat Enterprise Linux 3
xpdf-1:2.02-9.8
Fixed · RHSA-2005:840
Red Hat Enterprise Linux 4
cups-1:1.1.22-0.rc1.9.9
Fixed · RHSA-2005:878
Red Hat Enterprise Linux 4
gpdf-0:2.8.2-7.3
Fixed · RHSA-2005:867
Red Hat Enterprise Linux 4
kdegraphics-7:3.3.1-3.6
Fixed · RHSA-2005:868
Red Hat Enterprise Linux 4
tetex-0:2.0.2-22.EL4.7
Fixed · RHSA-2006:0160
Red Hat Enterprise Linux 4
xpdf-1:3.00-11.10
Fixed · RHSA-2005:840
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | cups-1:1.1.17-13.3.34 | Fixed | RHSA-2005:878 |
| Red Hat Enterprise Linux 3 | tetex-0:1.0.7-67.9 | Fixed | RHSA-2006:0160 |
| Red Hat Enterprise Linux 3 | xpdf-1:2.02-9.8 | Fixed | RHSA-2005:840 |
| Red Hat Enterprise Linux 4 | cups-1:1.1.22-0.rc1.9.9 | Fixed | RHSA-2005:878 |
| Red Hat Enterprise Linux 4 | gpdf-0:2.8.2-7.3 | Fixed | RHSA-2005:867 |
| Red Hat Enterprise Linux 4 | kdegraphics-7:3.3.1-3.6 | Fixed | RHSA-2005:868 |
| Red Hat Enterprise Linux 4 | tetex-0:2.0.2-22.EL4.7 | Fixed | RHSA-2006:0160 |
| Red Hat Enterprise Linux 4 | xpdf-1:3.00-11.10 | Fixed | RHSA-2005:840 |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
5.1 MEDIUM NVD
AV:N/AC:H/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.08% 0.04082
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.04082
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (12 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 4.08% (0.04082) | 90.39th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.08% (0.04082) | 89.37th | v5 (v2026.06.15) |
| Mar 30, 2025 | 3.03% (0.03031) | 85.44th | v4 (v2025.03.14) |
| Mar 29, 2025 | 7.66% (0.07665) | 86.20th | v4 (v2025.03.14) |
| Mar 17, 2025 | 3.03% (0.03031) | 85.73th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.48% (0.00477) | 76.56th | v3 (v2023.03.01) |
| Feb 8, 2024 | 0.61% (0.00608) | 77.93th | v3 (v2023.03.01) |
| Jun 18, 2023 | 0.61% (0.00608) | 75.61th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.49% (0.00493) | 72.47th | v3 (v2023.03.01) |
| Mar 6, 2023 | 10.19% (0.10194) | 94.57th | v2 (v2022.01.01) |
| Apr 1, 2022 | 10.19% (0.10194) | 94.10th | v2 (v2022.01.01) |
| Feb 4, 2022 | 10.19% (0.10194) | 87.60th | v2 (v2022.01.01) |
Weaknesses (1)
References (120)
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt vendor-advisoryx_refsource_SCO
- ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.20/SCOSA-2006.20.txt vendor-advisoryx_refsource_SCO
- ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2006.21/SCOSA-2006.21.txt vendor-advisoryx_refsource_SCO
- ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U vendor-advisoryx_refsource_SGI
- ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U vendor-advisoryx_refsource_SGI
- ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U vendor-advisoryx_refsource_SGI
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=342289 x_refsource_MISC
- http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html vendor-advisoryx_refsource_SUSE
- http://rhn.redhat.com/errata/RHSA-2005-868.html vendor-advisoryx_refsource_REDHATVendor Advisory
- http://secunia.com/advisories/17897 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17908 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17912 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17916 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17920 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17921 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17926 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17929 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17940 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/17955 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/17976 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18009 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18055 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18061 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18147 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18189 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18191 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18192 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18303 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18313 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18336 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18349 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18380 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18385 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18387 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18389 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18398 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18407 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18416 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/18428 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18436 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18448 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18503 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18517 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18534 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18549 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18554 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18582 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18674 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18675 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18679 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18908 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/18913 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/19230 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/19377 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/19797 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/19798 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/25729 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/26413 third-party-advisoryx_refsource_SECUNIA
- http://securityreason.com/securityalert/233 third-party-advisoryx_refsource_SREASON
- http://securityreason.com/securityalert/234 third-party-advisoryx_refsource_SREASON
- http://securitytracker.com/id?1015309 vdb-entryx_refsource_SECTRACK
- http://securitytracker.com/id?1015324 vdb-entryx_refsource_SECTRACK
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683 vendor-advisoryx_refsource_SLACKWARE
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747 vendor-advisoryx_refsource_SLACKWARE
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1 vendor-advisoryx_refsource_SUNALERT
- http://www.debian.org/security/2005/dsa-931 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2005/dsa-932 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2005/dsa-937 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2005/dsa-938 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2005/dsa-940 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2006/dsa-936 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2006/dsa-950 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2006/dsa-961 vendor-advisoryx_refsource_DEBIAN
- http://www.debian.org/security/2006/dsa-962 vendor-advisoryx_refsource_DEBIAN
- http://www.gentoo.org/security/en/glsa/glsa-200512-08.xml vendor-advisoryx_refsource_GENTOO
- http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml vendor-advisoryx_refsource_GENTOO
- http://www.idefense.com/application/poi/display?id=342&type=vulnerabilities third-party-advisoryx_refsource_IDEFENSEPatchVendor Advisory
- http://www.idefense.com/application/poi/display?id=343&type=vulnerabilities third-party-advisoryx_refsource_IDEFENSEPatchVendor Advisory
- http://www.kde.org/info/security/advisory-20051207-1.txt x_refsource_CONFIRM
- http://www.kde.org/info/security/advisory-20051207-2.txt x_refsource_CONFIRM
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:003 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:004 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:005 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:006 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:008 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:010 vendor-advisoryx_refsource_MANDRAKE
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:011 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:012 vendor-advisoryx_refsource_MANDRIVA
- http://www.novell.com/linux/security/advisories/2005_29_sr.html vendor-advisoryx_refsource_SUSE
- http://www.novell.com/linux/security/advisories/2006_02_sr.html vendor-advisoryx_refsource_SUSE
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html vendor-advisoryx_refsource_FEDORA
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html vendor-advisoryx_refsource_FEDORA
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00036.html vendor-advisoryx_refsource_FEDORA
- http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00037.html vendor-advisoryx_refsource_FEDORA
- http://www.redhat.com/support/errata/RHSA-2005-840.html vendor-advisoryx_refsource_REDHATVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-867.html vendor-advisoryx_refsource_REDHATVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-878.html vendor-advisoryx_refsource_REDHATVendor Advisory
- http://www.redhat.com/support/errata/RHSA-2006-0160.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/archive/1/418883/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/archive/1/427053/100/0/threaded vendor-advisoryx_refsource_FEDORA
- http://www.securityfocus.com/archive/1/427990/100/0/threaded vendor-advisoryx_refsource_FEDORA
- http://www.securityfocus.com/bid/15726 vdb-entryx_refsource_BID
- http://www.securityfocus.com/bid/15727 vdb-entryx_refsource_BID
- http://www.trustix.org/errata/2005/0072/ vendor-advisoryx_refsource_TRUSTIX
- http://www.ubuntulinux.org/usn/usn-227-1 vendor-advisoryx_refsource_UBUNTU
- http://www.vupen.com/english/advisories/2005/2786 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2005/2787 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2005/2788 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2005/2789 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2005/2790 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2005/2856 vdb-entryx_refsource_VUPEN
- http://www.vupen.com/english/advisories/2007/2280 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2005-3191 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1617796 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23443 vdb-entryx_refsource_XF
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23444 vdb-entryx_refsource_XF
- https://issues.rpath.com/browse/RPL-1609 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2005-3191
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9760 vdb-entrysignaturex_refsource_OVAL
- https://www.cve.org/CVERecord?id=CVE-2005-3191
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 7, 2005
Updated Aug 7, 2024
Reserved Oct 14, 2005
Link CVE-2005-3191
CISA Vulnrichment
Updated n/a