CVE-2005-2097
Fixed in a distro release EPSS <1%
xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cups | 1.1.22-7 |
| Debian 12 | libextractor | 0.5.8-1 |
| Debian 12 | poppler | 0.4.0-1 |
| Debian 12 | xpdf | 3.00-15 |
| Debian 13 | cups | 1.1.22-7 |
| Debian 13 | libextractor | 0.5.8-1 |
| Debian 13 | poppler | 0.4.0-1 |
| Debian 13 | xpdf | 3.00-15 |
| Debian 14 | cups | 1.1.22-7 |
| Debian 14 | libextractor | 0.5.8-1 |
| Debian 14 | poppler | 0.4.0-1 |
| Debian 14 | xpdf | 3.00-15 |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge5 |
| Debian 3.1 | gpdf | 2.8.2-1.2sarge4 |
| Debian 3.1 | kdegraphics | 4:3.3.2-2sarge1 |
| Debian 3.1 | libextractor | 0.4.2-2sarge2 |
| Debian 3.1 | xpdf | 3.00-13.6 |
| Debian 4.0 | gpdf | 2.10.0-1+etch1 |
| Red Hat Enterprise Linux 3 | cups | 1:1.1.17-13.3.31 |
| Red Hat Enterprise Linux 3 | cups-debuginfo | 1:1.1.17-13.3.31 |
| Red Hat Enterprise Linux 3 | cups-devel | 1:1.1.17-13.3.31 |
| Red Hat Enterprise Linux 3 | cups-libs | 1:1.1.17-13.3.31 |
| Red Hat Enterprise Linux 4 | cups | 1:1.1.22-0.rc1.9.7 |
| Red Hat Enterprise Linux 4 | cups-debuginfo | 1:1.1.22-0.rc1.9.7 |
| Red Hat Enterprise Linux 4 | cups-devel | 1:1.1.22-0.rc1.9.7 |
| Red Hat Enterprise Linux 4 | cups-libs | 1:1.1.22-0.rc1.9.7 |
| Red Hat Enterprise Linux 4 | gpdf | 0:2.8.2-4.4 |
| Red Hat Enterprise Linux 4 | gpdf-debuginfo | 0:2.8.2-4.4 |
| Red Hat Enterprise Linux 4 | kdegraphics | 7:3.3.1-3.4 |
| Red Hat Enterprise Linux 4 | kdegraphics-debuginfo | 7:3.3.1-3.4 |
| Red Hat Enterprise Linux 4 | kdegraphics-devel | 7:3.3.1-3.4 |
| Red Hat Enterprise Linux 4 | xpdf | 1:3.00-11.8 |
| Red Hat Enterprise Linux 4 | xpdf-debuginfo | 1:3.00-11.8 |