CVE-2005-3628

Description

Buffer overflow in the JBIG2Bitmap::JBIG2Bitmap function in JBIG2Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via unknown attack vectors.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 2.68% Top 15%

Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory securityfocus.com Vendor Advisory suse.com Vendor Advisory debian.org Vendor Advisory slackware.com Vendor Advisory sgi.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory debian.org Vendor Advisory slackware.com Vendor Advisory securityfocus.com Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory mandriva.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://www.debian.org/security/2005/dsa-932	vendor advisory
http://secunia.com/advisories/18147	third party advisory
http://secunia.com/advisories/18679	third party advisory
http://www.debian.org/security/2005/dsa-931	vendor advisory
http://secunia.com/advisories/19230	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:012	vendor advisory
http://www.debian.org/security/2006/dsa-962	vendor advisory
http://www.debian.org/security/2005/dsa-937	vendor advisory
http://secunia.com/advisories/18398	patch vendor advisory third party advisory
http://www.securityfocus.com/archive/1/427053/100/0/threaded	vendor advisory
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html	patch vendor advisory
http://www.debian.org/security/2006/dsa-936	patch vendor advisory
http://secunia.com/advisories/18674	third party advisory
http://secunia.com/advisories/18436	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10287	signature vdb entry
http://secunia.com/advisories/18428	third party advisory
http://secunia.com/advisories/18380	third party advisory
http://secunia.com/advisories/18416	patch vendor advisory third party advisory
http://secunia.com/advisories/18407	patch vendor advisory third party advisory
http://secunia.com/advisories/18582	patch vendor advisory third party advisory
http://secunia.com/advisories/18534	patch vendor advisory third party advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683	vendor advisory
http://secunia.com/advisories/18908	third party advisory
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U	vendor advisory
http://www.redhat.com/support/errata/RHSA-2006-0160.html	patch vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010	vendor advisory
http://www.debian.org/security/2005/dsa-940	vendor advisory
http://secunia.com/advisories/18389	patch vendor advisory third party advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747	vendor advisory
http://www.securityfocus.com/archive/1/427990/100/0/threaded	vendor advisory
http://www.debian.org/security/2006/dsa-961	vendor advisory
http://secunia.com/advisories/18675	third party advisory
http://secunia.com/advisories/18913	third party advisory
http://www.debian.org/security/2005/dsa-938	vendor advisory
http://www.debian.org/security/2006/dsa-950	patch vendor advisory
http://secunia.com/advisories/18387	patch vendor advisory third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:011	vendor advisory
http://secunia.com/advisories/18385	patch vendor advisory third party advisory

Frequently Asked Questions

What is the severity of CVE-2005-3628?: CVE-2005-3628 has been scored as a high severity vulnerability.
How to fix CVE-2005-3628?: To fix CVE-2005-3628, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2005-3628 being actively exploited in the wild?: It is possible that CVE-2005-3628 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~3% probability that this vulnerability will be exploited by malicious actors in the next 30 days.