CVE Feed

    Dashboard / CVE / CVE-2005-2097

    CVE-2005-2097

    xpdf and kpdf do not properly validate the "loca" table in PDF files, which allows local users to cause a denial of service (disk consumption and hang) via a PDF file with a "broken" loca table, which causes a large temporary file to be created when xpdf attempts to reconstruct the information.

    Published:Aug 9, 2005
    Last Modified:Apr 16, 2026
    EPS:Aug 16, 2005
    EPSS Score:0.00072
    CVSS Score:2.1

    Affected Products

    Vendor
    Kde
    Product
    Kpdf
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Xpdf
    Product
    Xpdf

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2009-4035 (CVSS 9.3) — The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf 2.8.2, kpdf in kdegraphics 3.3.1, and p…
    CVE-2009-3604 (CVSS 9.3) — The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GP…
    CVE-2009-3609 (CVSS 4.3) — Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler befo…
    CVE-2009-3606 (CVSS 9.3) — Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in…
    CVE-2009-3608 (CVSS 9.3) — Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler …
    CVE-2005-3625 (CVSS 10) — Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allow…
    CVE-2005-3624 (CVSS 5) — The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS…
    CVE-2005-3626 (CVSS 5) — Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allow…
    CVE-2004-0889 (CVSS 10) — Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attac…
    CVE-2004-0888 (CVSS 10) — Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and …

    References

    ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.42/SCOSA-2005.42.txt
    http://secunia.com/advisories/17277
    http://secunia.com/advisories/18398
    http://secunia.com/advisories/18407
    http://secunia.com/advisories/21339
    http://secunia.com/advisories/25729
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1
    http://www.debian.org/security/2005/dsa-780
    http://www.debian.org/security/2006/dsa-1136
    http://www.debian.org/security/2006/dsa-936
    http://www.mandriva.com/security/advisories?name=MDKSA-2005:138
    http://www.novell.com/linux/security/advisories/2005_19_sr.html
    http://www.redhat.com/support/errata/RHSA-2005-670.html
    http://www.redhat.com/support/errata/RHSA-2005-671.html
    http://www.redhat.com/support/errata/RHSA-2005-706.html
    http://www.redhat.com/support/errata/RHSA-2005-708.html
    http://www.securityfocus.com/archive/1/427053/100/0/threaded
    http://www.securityfocus.com/archive/1/427990/100/0/threaded
    http://www.securityfocus.com/bid/14529
    http://www.vupen.com/english/advisories/2007/2280
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10280
    https://usn.ubuntu.com/163-1/
    ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.42/SCOSA-2005.42.txt
    http://secunia.com/advisories/17277
    http://secunia.com/advisories/18398
    http://secunia.com/advisories/18407
    http://secunia.com/advisories/21339
    http://secunia.com/advisories/25729
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-102972-1
    http://www.debian.org/security/2005/dsa-780
    http://www.debian.org/security/2006/dsa-1136
    http://www.debian.org/security/2006/dsa-936
    http://www.mandriva.com/security/advisories?name=MDKSA-2005:138
    http://www.novell.com/linux/security/advisories/2005_19_sr.html
    http://www.redhat.com/support/errata/RHSA-2005-670.html
    http://www.redhat.com/support/errata/RHSA-2005-671.html
    http://www.redhat.com/support/errata/RHSA-2005-706.html
    http://www.redhat.com/support/errata/RHSA-2005-708.html
    http://www.securityfocus.com/archive/1/427053/100/0/threaded
    http://www.securityfocus.com/archive/1/427990/100/0/threaded
    http://www.securityfocus.com/bid/14529
    http://www.vupen.com/english/advisories/2007/2280
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10280
    https://usn.ubuntu.com/163-1/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High