Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2006-1244

Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature.

Published

2006-03-15T19:06:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.6 (HIGH)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: HIGH
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

4.9

Impact Score

10.0

Weaknesses

Type: Primary
NVD-CWE-Other

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gnome	gpdf	2.8.2	Yes
Application	libextractor	libextractor	0.3.6	Yes
Application	libextractor	libextractor	0.3.7	Yes
Application	libextractor	libextractor	0.3.8	Yes
Application	libextractor	libextractor	0.3.9	Yes
Application	libextractor	libextractor	0.3.11	Yes
Application	libextractor	libextractor	0.4	Yes
Application	libextractor	libextractor	0.4.1	Yes
Application	libextractor	libextractor	0.4.2	Yes
Application	libextractor	libextractor	0.5	Yes
Application	xpdf	xpdf	0.90	Yes
Application	xpdf	xpdf	0.91	Yes
Application	xpdf	xpdf	0.92	Yes
Application	xpdf	xpdf	0.93	Yes
Application	xpdf	xpdf	1.0	Yes
Application	xpdf	xpdf	1.0a	Yes
Application	xpdf	xpdf	1.1	Yes
Application	xpdf	xpdf	2.0	Yes
Application	xpdf	xpdf	2.1	Yes
Application	xpdf	xpdf	2.2	Yes
Application	xpdf	xpdf	2.3	Yes
Application	xpdf	xpdf	3.0	Yes
Application	xpdf	xpdf	3.0.1	Yes
Application	xpdf	xpdf	3.0.1_pl1	Yes
Application	xpdf	xpdf	3.0_pl2	Yes
Application	xpdf	xpdf	3.0_pl3	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	3.1	Yes

References

http://secunia.com/advisories/18948 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/19021 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/19065 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/19091 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/19164 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/19364 Patch, Vendor Advisory ([email protected])
http://secunia.com/advisories/19644 Patch, Vendor Advisory ([email protected])
http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3.diff.gz Patch ([email protected])
http://www.debian.org/security/2006/dsa-1019 Patch, Vendor Advisory ([email protected])
http://www.debian.org/security/2006/dsa-979 Patch, Vendor Advisory ([email protected])
http://www.debian.org/security/2006/dsa-982 Patch, Vendor Advisory ([email protected])
http://www.debian.org/security/2006/dsa-983 Patch, Vendor Advisory ([email protected])
http://www.debian.org/security/2006/dsa-984 Patch, Vendor Advisory ([email protected])
http://www.debian.org/security/2006/dsa-998 Patch, Vendor Advisory ([email protected])
http://www.osvdb.org/23834 ([email protected])
http://www.securityfocus.com/bid/16748 ([email protected])
https://usn.ubuntu.com/270-1/ ([email protected])
http://secunia.com/advisories/18948 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/19021 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/19065 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/19091 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/19164 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/19364 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/19644 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3.diff.gz Patch (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2006/dsa-1019 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2006/dsa-979 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2006/dsa-982 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2006/dsa-983 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2006/dsa-984 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2006/dsa-998 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.osvdb.org/23834 (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/16748 (af854a3a-2127-422b-91ae-364da2661108)
https://usn.ubuntu.com/270-1/ (af854a3a-2127-422b-91ae-364da2661108)