CVE-2006-1244
Unspecified vulnerability in certain versions of xpdf after 3.00, as used in various products including (a) pdfkit.framework, (b) gpdf, (c) pdftohtml, and (d) libextractor, has unknown impact and user-assisted attack vectors, possibly involving errors in (1) gmem.c, (2) SplashXPathScanner.cc, (3) JBIG2Stream.cc, (4) JPXStream.cc, and/or (5) Stream.cc. NOTE: this description is based on Debian advisory DSA 979, which is based on changes that were made after other vulnerabilities such as CVE-2006-0301 and CVE-2005-3624 through CVE-2005-3628 were fixed. Some of these newer fixes appear to be security-relevant, although it is not clear if they fix specific issues or are defensive in nature.
| Software | From | Fixed in |
|---|---|---|
| xpdf / xpdf | 2.0 | 2.0.x |
| libextractor / libextractor | 0.3.11 | 0.3.11.x |
| xpdf / xpdf | 3.0_pl3 | 3.0_pl3.x |
| xpdf / xpdf | 1.0 | 1.0.x |
| libextractor / libextractor | 0.4.1 | 0.4.1.x |
| libextractor / libextractor | 0.4.2 | 0.4.2.x |
| xpdf / xpdf | 3.0.1_pl1 | 3.0.1_pl1.x |
| xpdf / xpdf | 0.91 | 0.91.x |
| libextractor / libextractor | 0.4 | 0.4.x |
| libextractor / libextractor | 0.3.8 | 0.3.8.x |
| xpdf / xpdf | 2.3 | 2.3.x |
| xpdf / xpdf | 0.92 | 0.92.x |
| xpdf / xpdf | 3.0.1 | 3.0.1.x |
| gnome / gpdf | 2.8.2 | 2.8.2.x |
| xpdf / xpdf | 1.0a | 1.0a.x |
| libextractor / libextractor | 0.3.9 | 0.3.9.x |
| xpdf / xpdf | 2.2 | 2.2.x |
| xpdf / xpdf | 3.0_pl2 | 3.0_pl2.x |
| xpdf / xpdf | 2.1 | 2.1.x |
| xpdf / xpdf | 0.90 | 0.90.x |
| xpdf / xpdf | 3.0 | 3.0.x |
| libextractor / libextractor | 0.5 | 0.5.x |
| xpdf / xpdf | 0.93 | 0.93.x |
| libextractor / libextractor | 0.3.7 | 0.3.7.x |
| libextractor / libextractor | 0.3.6 | 0.3.6.x |
| xpdf / xpdf | 1.1 | 1.1.x |
| debian / debian_linux | 3.1 | 3.1.x |
- http://secunia.com/advisories/18948
- http://secunia.com/advisories/19021
- http://secunia.com/advisories/19065
- http://secunia.com/advisories/19091
- http://secunia.com/advisories/19164
- http://secunia.com/advisories/19364
- http://secunia.com/advisories/19644
- http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3.diff.gz
- http://www.debian.org/security/2006/dsa-1019
- http://www.debian.org/security/2006/dsa-979
- http://www.debian.org/security/2006/dsa-982
- http://www.debian.org/security/2006/dsa-983
- http://www.debian.org/security/2006/dsa-984
- http://www.debian.org/security/2006/dsa-998
- http://www.osvdb.org/23834
- http://www.securityfocus.com/bid/16748
- https://usn.ubuntu.com/270-1/
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime