Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2005-3627 Details

Description

Stream.cc in Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to modify memory and possibly execute arbitrary code via a DCTDecode stream with (1) a large "number of components" value that is not checked by DCTStream::readBaselineSOF or DCTStream::readProgressiveSOF, (2) a large "Huffman table index" value that is not checked by DCTStream::readHuffmanTables, and (3) certain uses of the scanInfo.numComps value by DCTStream::readScanInfo.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt	CVE
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U	CVE
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U	CVE
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U	CVE
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html	CVE	PatchVendor Advisory
http://rhn.redhat.com/errata/RHSA-2006-0177.html	CVE	PatchVendor Advisory
http://scary.beasts.org/security/CESA-2005-003.txt	CVE	ExploitVendor Advisory
http://secunia.com/advisories/18147	CVE
http://secunia.com/advisories/18303	CVE	PatchVendor Advisory
http://secunia.com/advisories/18312	CVE	PatchVendor Advisory
http://secunia.com/advisories/18313	CVE	PatchVendor Advisory
http://secunia.com/advisories/18329	CVE	Vendor Advisory
http://secunia.com/advisories/18332	CVE	Vendor Advisory
http://secunia.com/advisories/18334	CVE	PatchVendor Advisory
http://secunia.com/advisories/18335	CVE	PatchVendor Advisory
http://secunia.com/advisories/18338	CVE	PatchVendor Advisory
http://secunia.com/advisories/18349	CVE	PatchVendor Advisory
http://secunia.com/advisories/18373	CVE
http://secunia.com/advisories/18375	CVE	Vendor Advisory
http://secunia.com/advisories/18380	CVE
http://secunia.com/advisories/18385	CVE	PatchVendor Advisory
http://secunia.com/advisories/18387	CVE	PatchVendor Advisory
http://secunia.com/advisories/18389	CVE	PatchVendor Advisory
http://secunia.com/advisories/18398	CVE	PatchVendor Advisory
http://secunia.com/advisories/18407	CVE	PatchVendor Advisory
http://secunia.com/advisories/18414	CVE
http://secunia.com/advisories/18416	CVE	PatchVendor Advisory
http://secunia.com/advisories/18423	CVE	PatchVendor Advisory
http://secunia.com/advisories/18425	CVE
http://secunia.com/advisories/18428	CVE
http://secunia.com/advisories/18436	CVE
http://secunia.com/advisories/18448	CVE	PatchVendor Advisory
http://secunia.com/advisories/18463	CVE
http://secunia.com/advisories/18517	CVE	PatchVendor Advisory
http://secunia.com/advisories/18534	CVE	PatchVendor Advisory
http://secunia.com/advisories/18554	CVE	PatchVendor Advisory
http://secunia.com/advisories/18582	CVE	PatchVendor Advisory
http://secunia.com/advisories/18642	CVE	Vendor Advisory
http://secunia.com/advisories/18644	CVE	Vendor Advisory
http://secunia.com/advisories/18674	CVE	Vendor Advisory
http://secunia.com/advisories/18675	CVE	Vendor Advisory
http://secunia.com/advisories/18679	CVE	Vendor Advisory
http://secunia.com/advisories/18908	CVE	Vendor Advisory
http://secunia.com/advisories/18913	CVE
http://secunia.com/advisories/19230	CVE
http://secunia.com/advisories/19377	CVE
http://secunia.com/advisories/25729	CVE
https://exchange.xforce.ibmcloud.com/vulnerabilities/24024	CVE
https://exchange.xforce.ibmcloud.com/vulnerabilities/24025	CVE
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683	CVE
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747	CVE
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10200	CVE
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1	CVE
https://usn.ubuntu.com/236-1/	CVE
http://www.debian.org/security/2005/dsa-931	CVE
http://www.debian.org/security/2005/dsa-932	CVE
http://www.debian.org/security/2005/dsa-937	CVE
http://www.debian.org/security/2005/dsa-938	CVE
http://www.debian.org/security/2005/dsa-940	CVE
http://www.debian.org/security/2006/dsa-936	CVE	PatchVendor Advisory
http://www.debian.org/security/2006/dsa-950	CVE	PatchVendor Advisory
http://www.debian.org/security/2006/dsa-961	CVE	PatchVendor Advisory
http://www.debian.org/security/2006/dsa-962	CVE
http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml	CVE	PatchVendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml	CVE
http://www.kde.org/info/security/advisory-20051207-2.txt	CVE	Patch
http://www.mandriva.com/security/advisories?name=MDKSA-2006:003	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:004	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:005	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:006	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:008	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:011	CVE
http://www.mandriva.com/security/advisories?name=MDKSA-2006:012	CVE
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html	CVE	Patch
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html	CVE	Patch
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00030.html	CVE
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00031.html	CVE
http://www.redhat.com/support/errata/RHSA-2006-0160.html	CVE	PatchVendor Advisory
http://www.redhat.com/support/errata/RHSA-2006-0163.html	CVE
http://www.securityfocus.com/archive/1/427053/100/0/threaded	CVE
http://www.securityfocus.com/archive/1/427990/100/0/threaded	CVE
http://www.securityfocus.com/bid/16143	CVE	Patch
http://www.trustix.org/errata/2006/0002/	CVE
http://www.vupen.com/english/advisories/2006/0047	CVE
http://www.vupen.com/english/advisories/2007/2280	CVE
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.15/SCOSA-2006.15.txt	[email protected]
ftp://patches.sgi.com/support/free/security/advisories/20051201-01-U	[email protected]
ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U	[email protected]
ftp://patches.sgi.com/support/free/security/advisories/20060201-01-U	[email protected]
http://lists.suse.com/archive/suse-security-announce/2006-Jan/0001.html	[email protected]	PatchVendor Advisory
http://rhn.redhat.com/errata/RHSA-2006-0177.html	[email protected]	PatchVendor Advisory
http://scary.beasts.org/security/CESA-2005-003.txt	[email protected]	ExploitVendor Advisory
http://secunia.com/advisories/18147	[email protected]
http://secunia.com/advisories/18303	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18312	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18313	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18329	[email protected]	Vendor Advisory
http://secunia.com/advisories/18332	[email protected]	Vendor Advisory
http://secunia.com/advisories/18334	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18335	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18338	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18349	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18373	[email protected]
http://secunia.com/advisories/18375	[email protected]	Vendor Advisory
http://secunia.com/advisories/18380	[email protected]
http://secunia.com/advisories/18385	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18387	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18389	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18398	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18407	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18414	[email protected]
http://secunia.com/advisories/18416	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18423	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18425	[email protected]
http://secunia.com/advisories/18428	[email protected]
http://secunia.com/advisories/18436	[email protected]
http://secunia.com/advisories/18448	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18463	[email protected]
http://secunia.com/advisories/18517	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18534	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18554	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18582	[email protected]	PatchVendor Advisory
http://secunia.com/advisories/18642	[email protected]	Vendor Advisory
http://secunia.com/advisories/18644	[email protected]	Vendor Advisory
http://secunia.com/advisories/18674	[email protected]	Vendor Advisory
http://secunia.com/advisories/18675	[email protected]	Vendor Advisory
http://secunia.com/advisories/18679	[email protected]	Vendor Advisory
http://secunia.com/advisories/18908	[email protected]	Vendor Advisory
http://secunia.com/advisories/18913	[email protected]
http://secunia.com/advisories/19230	[email protected]
http://secunia.com/advisories/19377	[email protected]
http://secunia.com/advisories/25729	[email protected]
https://exchange.xforce.ibmcloud.com/vulnerabilities/24024	[email protected]
https://exchange.xforce.ibmcloud.com/vulnerabilities/24025	[email protected]
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.472683	[email protected]
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.474747	[email protected]
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10200	[email protected]
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1	[email protected]
https://usn.ubuntu.com/236-1/	[email protected]
http://www.debian.org/security/2005/dsa-931	[email protected]
http://www.debian.org/security/2005/dsa-932	[email protected]
http://www.debian.org/security/2005/dsa-937	[email protected]
http://www.debian.org/security/2005/dsa-938	[email protected]
http://www.debian.org/security/2005/dsa-940	[email protected]
http://www.debian.org/security/2006/dsa-936	[email protected]	PatchVendor Advisory
http://www.debian.org/security/2006/dsa-950	[email protected]	PatchVendor Advisory
http://www.debian.org/security/2006/dsa-961	[email protected]	PatchVendor Advisory
http://www.debian.org/security/2006/dsa-962	[email protected]
http://www.gentoo.org/security/en/glsa/glsa-200601-02.xml	[email protected]	PatchVendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200601-17.xml	[email protected]
http://www.kde.org/info/security/advisory-20051207-2.txt	[email protected]	Patch
http://www.mandriva.com/security/advisories?name=MDKSA-2006:003	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2006:004	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2006:005	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2006:006	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2006:008	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2006:010	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2006:011	[email protected]
http://www.mandriva.com/security/advisories?name=MDKSA-2006:012	[email protected]
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00010.html	[email protected]	Patch
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00011.html	[email protected]	Patch
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00030.html	[email protected]
http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00031.html	[email protected]
http://www.redhat.com/support/errata/RHSA-2006-0160.html	[email protected]	PatchVendor Advisory
http://www.redhat.com/support/errata/RHSA-2006-0163.html	[email protected]
http://www.securityfocus.com/archive/1/427053/100/0/threaded	[email protected]
http://www.securityfocus.com/archive/1/427990/100/0/threaded	[email protected]
http://www.securityfocus.com/bid/16143	[email protected]	Patch
http://www.trustix.org/errata/2006/0002/	[email protected]
http://www.vupen.com/english/advisories/2006/0047	[email protected]
http://www.vupen.com/english/advisories/2007/2280	[email protected]

see all 172 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	[email protected]
NVD-CWE-noinfo	Insufficient Information to Classify Weakness	[email protected]

Affected Products

Product	Versions
xpdf xpdf	All versions
CPE cpe:2.3:a:xpdf:xpdf:::::::: Remediation No remediation found in references.

Change History

11 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 16, 2026		[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Oct 19, 2018	CVE Modified	[email protected]
Oct 3, 2018	CVE Modified	[email protected]
Oct 11, 2017	CVE Modified	[email protected]
Jul 11, 2017	CVE Modified	[email protected]
Feb 19, 2017	CVE Modified	[email protected]
Nov 19, 2016	CVE Modified	[email protected]
Jun 5, 2006	Initial Analysis	[email protected]