CVE-2007-3387

CVE Details

Release Date:

2007-07-30

Description

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

See more information about CVE-2007-3387 from MITRE CVE dictionary and NIST NVD

CVSS v2.0 metrics

NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score:	6.8	Base Metrics:	AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector:	Network	Attack Complexity:	Medium
Authentication:	None required	Confidentiality Impact:	Partial
Integrity Impact:	Partial	Availability Impact:	Partial

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 3 (cups)	ELSA-2007-0720	2007-07-30
Oracle Enterprise Linux version 3 (tetex)	ELSA-2007-0731	2007-08-01
Oracle Enterprise Linux version 3 (xpdf)	ELSA-2007-0735	2007-07-30
Oracle Enterprise Linux version 4 (cups)	ELSA-2007-0720	2007-07-30
Oracle Enterprise Linux version 4 (gpdf)	ELSA-2007-0730	2007-07-30
Oracle Enterprise Linux version 4 (kdegraphics)	ELSA-2007-0729	2007-07-30
Oracle Enterprise Linux version 4 (tetex)	ELSA-2007-0731	2007-08-01
Oracle Enterprise Linux version 4 (xpdf)	ELSA-2007-0735	2007-07-30
Oracle Linux version 5 (cups)	ELSA-2007-0720	2007-07-30
Oracle Linux version 5 (poppler)	ELSA-2007-0732	2007-07-30
Oracle Linux version 5 (tetex)	ELSA-2007-0731	2007-08-01

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team