From 2a2ea79881b752eaf1521724d0be6ee856a6b195 Mon Sep 17 00:00:00 2001 From: "Simon L. B. Nielsen" Date: Thu, 11 Aug 2005 22:18:53 +0000 Subject: [PATCH] Document xpdf -- disk fill DoS vulnerability. Approved by: portmgr (blanket, VuXML) --- security/vuxml/vuln.xml | 45 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 4d829ea7b112..0298bc63cd38 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,51 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> + + xpdf -- disk fill DoS vulnerability + + + xpdf + 3.00_7 + + + kdegraphics + 3.4.2 + + + pdftohtml + 0.36_3 + + + gpdf + cups-base + 0 + + + + +

xpdf is vulnerable to a denial of service vulnerability + which can cause xpdf to create an infinitely large file, + thereby filling up the /tmp partition, when opening a + specially crafted PDF file.

+

Note that several applications contains an embedded version + on xpdf, therefor making them the vulnerable to the same + DoS. In CUPS this vulnerability would cause the pdftops + filter to crash.

+ + + + 14529 + CAN-2005-2097 + http://rhn.redhat.com/errata/RHSA-2005-670.html + http://www.kde.org/info/security/advisory-20050809-1.txt + + + 2005-08-09 + 2005-08-12 + + + gforge -- XSS and email flood vulnerabilities