CVE-2007-3387

CVE Details

Release Date:	2007-07-30
Impact:	Important	What is this?

Description

Integer overflow in the StreamPredictor::StreamPredictor function in xpdf 3.02, as used in (1) poppler before 0.5.91, (2) gpdf before 2.8.2, (3) kpdf, (4) kdegraphics, (5) CUPS, (6) PDFedit, and other products, might allow remote attackers to execute arbitrary code via a crafted PDF file that triggers a stack-based buffer overflow in the StreamPredictor::getNextLine function.

See more information about CVE-2007-3387 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	6.8
Vector String:	AV:N/AC:M/Au:N/C:P/I:P/A:P
Version:	2.0
Attack Vector:	Network
Attack Complexity:	Medium
Authentication:	None
Confidentiality Impact:	Partial
Integrity Impact:	Partial
Availability Impact:	Partial

Errata information

Platform	Errata	Release Date
Oracle Enterprise Linux version 3 (cups)	ELSA-2007-0720	2007-07-30
Oracle Enterprise Linux version 3 (tetex)	ELSA-2007-0731	2007-08-01
Oracle Enterprise Linux version 3 (xpdf)	ELSA-2007-0735	2007-07-30
Oracle Enterprise Linux version 4 (cups)	ELSA-2007-0720	2007-07-30
Oracle Enterprise Linux version 4 (gpdf)	ELSA-2007-0730	2007-07-30
Oracle Enterprise Linux version 4 (kdegraphics)	ELSA-2007-0729	2007-07-30
Oracle Enterprise Linux version 4 (tetex)	ELSA-2007-0731	2007-08-01
Oracle Enterprise Linux version 4 (xpdf)	ELSA-2007-0735	2007-07-30
Oracle Linux version 5 (cups)	ELSA-2007-0720	2007-07-30
Oracle Linux version 5 (poppler)	ELSA-2007-0732	2007-07-30
Oracle Linux version 5 (tetex)	ELSA-2007-0731	2007-08-01