CVE-2007-5392

NameCVE-2007-5392
DescriptionInteger overflow in the DCTStream::reset method in xpdf/Stream.cc in ...
SourceCVE (at NVD; oss-sec, OSVDB, EDB, Red Hat, Ubuntu, Gentoo, SuSE, more)
ReferencesDSA-1480-1, DSA-1509-1, DSA-1537-1, DTSA-85-1, DTSA-86-1
Debian Bugs450628, 450629, 450630, 450631
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cups (PTS)squeeze1.4.4-7+squeeze3fixed
squeeze (security)1.4.4-7+squeeze4fixed
wheezy1.5.3-5+deb7u1fixed
jessie, sid1.7.2-1fixed
kdegraphics (PTS)squeeze4:4.4.5-2fixed
koffice (PTS)squeeze1:2.2.1-4fixed
libextractor (PTS)squeeze1:0.5.23+dfsg-7fixed
wheezy1:0.6.3-5fixed
jessie, sid1:1.3-1fixed
poppler (PTS)squeeze, squeeze (security)0.12.4-1.2+squeeze3fixed
wheezy0.18.4-6fixed
jessie, sid0.24.5-3fixed
swftools (PTS)wheezy0.9.2+ds1-3fixed
jessie, sid0.9.2+git20130725-2fixed
xpdf (PTS)squeeze3.02-12+squeeze1fixed
wheezy3.03-10fixed
jessie, sid3.03-17fixed

The information above is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cupssource(unstable)1.1.22-7
cupsyssource(unstable)(not affected)
gpdfsource(unstable)(unfixed)
kdegraphicssource(unstable)4:3.5.8-2medium450630
kdegraphicssourceetch(not affected)
kdegraphicssourcelenny4:3.5.7-4+lenny1DTSA-85-1
kofficesource(unstable)1:1.6.3-4medium450631
kofficesourceetch1:1.6.1-2etch2DSA-1509-1
kofficesourcelenny1:1.6.3-3+lenny1DTSA-86-1
libextractorsource(unstable)0.5.12-1
pdftohtmlsource(unstable)(unfixed)
pdftohtmlsourceetch0.36-13etch1
popplersource(unstable)0.6.2-1medium450628
popplersourceetch0.4.5-5.1etch2DSA-1480-1
swftoolssource(unstable)0.9.2+ds1-2
tetex-binunknown(unstable)3.0-12
xpdfsource(unstable)3.02-1.3medium450629
xpdfsourceetch3.01-9.1+etch2DSA-1537-1

Notes

[etch] - kdegraphics <not-affected> (Vulnerable code not used)
pdftex links to poppler since 3.0-12, thus marking as fixed
- cupsys <not-affected> (we use xpdf-utils in sarge and poppler-utils since etch to not embedd this code)
cups uses xpdf-utils and poppler-utils
libextractor uses internal pdf decoder since 0.5.12-1, thus marking as fixed

Search for package or bug name: Reporting problems

Home - Testing Security Team - Debian Security - Source (SVN)