CVE-2007-0104

Current Description

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Basic Data

PublishedJanuary 09, 2007
Last ModifiedOctober 16, 2018
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-20
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactPARTIAL
CVSS 2 - Base Score6.8
SeverityMEDIUM
Exploitability Score8.6
Impact Score6.4
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationXpdfXpdf3.0*******
    2.3ApplicationXpdfXpdf3.0.1*******
    2.3ApplicationXpdfXpdf3.0.1_pl1*******
    2.3ApplicationXpdfXpdf3.0.1_pl2*******
    2.3ApplicationXpdfXpdf3.0_pl2*******
  • OR - Configuration 2
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3OSKdeKde3.2*******
    2.3OSKdeKde3.2.1*******
    2.3OSKdeKde3.2.2*******
    2.3OSKdeKde3.2.3*******
    2.3OSKdeKde3.3*******
    2.3OSKdeKde3.3.1*******
    2.3OSKdeKde3.3.2*******
    2.3OSKdeKde3.4*******
    2.3OSKdeKde3.4.1*******
    2.3OSKdeKde3.4.2*******
    2.3OSKdeKde3.4.3*******
    2.3OSKdeKde3.5*******

Vulnerable Software List

VendorProductVersions
Xpdf Xpdf 3.0, 3.0.1, 3.0.1_pl1, 3.0.1_pl2, 3.0_pl2
Kde Kde 3.2, 3.2.1, 3.2.2, 3.2.3, 3.3, 3.3.1, 3.3.2, 3.4, 3.4.1, 3.4.2, 3.4.3, 3.5

References

NameSourceURLTags
http://docs.info.apple.com/article.html?artnum=305214http://docs.info.apple.com/article.html?artnum=305214CONFIRM
http://projects.info-pull.com/moab/MOAB-06-01-2007.htmlhttp://projects.info-pull.com/moab/MOAB-06-01-2007.htmlMISC
23791http://secunia.com/advisories/23791SECUNIA
23799http://secunia.com/advisories/23799SECUNIAVendor Advisory
23808http://secunia.com/advisories/23808SECUNIAVendor Advisory
23813http://secunia.com/advisories/23813SECUNIAVendor Advisory
23815http://secunia.com/advisories/23815SECUNIAVendor Advisory
23839http://secunia.com/advisories/23839SECUNIAVendor Advisory
23844http://secunia.com/advisories/23844SECUNIAVendor Advisory
23876http://secunia.com/advisories/23876SECUNIAVendor Advisory
24204http://secunia.com/advisories/24204SECUNIAVendor Advisory
24479http://secunia.com/advisories/24479SECUNIAVendor Advisory
1017514http://securitytracker.com/id?1017514SECTRACK
http://support.novell.com/techcenter/psdb/44d7cb9b669d58e0ce5aa5d7ab2c7c53.htmlhttp://support.novell.com/techcenter/psdb/44d7cb9b669d58e0ce5aa5d7ab2c7c53.htmlCONFIRM
http://www.kde.org/info/security/advisory-20070115-1.txthttp://www.kde.org/info/security/advisory-20070115-1.txtCONFIRM
MDKSA-2007:018http://www.mandriva.com/security/advisories?name=MDKSA-2007:018MANDRIVA
MDKSA-2007:019http://www.mandriva.com/security/advisories?name=MDKSA-2007:019MANDRIVA
MDKSA-2007:020http://www.mandriva.com/security/advisories?name=MDKSA-2007:020MANDRIVA
MDKSA-2007:021http://www.mandriva.com/security/advisories?name=MDKSA-2007:021MANDRIVA
MDKSA-2007:022http://www.mandriva.com/security/advisories?name=MDKSA-2007:022MANDRIVA
MDKSA-2007:024http://www.mandriva.com/security/advisories?name=MDKSA-2007:024MANDRIVA
SUSE-SR:2007:003http://www.novell.com/linux/security/advisories/2007_3_sr.htmlSUSE
20070116 [KDE Security Advisory] kpdf/kword/xpdf denial of service vulnerabilityhttp://www.securityfocus.com/archive/1/457055/100/0/threadedBUGTRAQ
21910http://www.securityfocus.com/bid/21910BIDExploit
1017749http://www.securitytracker.com/id?1017749SECTRACK
USN-410-1http://www.ubuntu.com/usn/usn-410-1UBUNTU
USN-410-2http://www.ubuntu.com/usn/usn-410-2UBUNTU
TA07-072Ahttp://www.us-cert.gov/cas/techalerts/TA07-072A.htmlCERTUS Government Resource
ADV-2007-0203http://www.vupen.com/english/advisories/2007/0203VUPENVendor Advisory
ADV-2007-0212http://www.vupen.com/english/advisories/2007/0212VUPENVendor Advisory
ADV-2007-0244http://www.vupen.com/english/advisories/2007/0244VUPENVendor Advisory
ADV-2007-0930http://www.vupen.com/english/advisories/2007/0930VUPENVendor Advisory
multiple-vendor-pdf-code-execution(31364)https://exchange.xforce.ibmcloud.com/vulnerabilities/31364XF
https://issues.rpath.com/browse/RPL-964https://issues.rpath.com/browse/RPL-964CONFIRM