6.7 Medium
AI Score
Confidence
Low
7.6 High
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
0.013 Low
EPSS
Percentile
85.4%
Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, © pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature.
secunia.com/advisories/18948
secunia.com/advisories/19021
secunia.com/advisories/19065
secunia.com/advisories/19091
secunia.com/advisories/19164
secunia.com/advisories/19364
secunia.com/advisories/19644
security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3.diff.gz
www.debian.org/security/2006/dsa-1019
www.debian.org/security/2006/dsa-979
www.debian.org/security/2006/dsa-982
www.debian.org/security/2006/dsa-983
www.debian.org/security/2006/dsa-984
www.debian.org/security/2006/dsa-998
www.osvdb.org/23834
www.securityfocus.com/bid/16748
usn.ubuntu.com/270-1/