01 Record

CVE-2007-5393

Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted

UnratedPUBLISHEDCNA: flexera

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 6.41% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 93.1% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-16.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2007-11-08 02:00Z18 YR AGO

Last updated

2024-08-07 15:31Z2 YR AGO

Reserved

2007-10-12

Assigning CNA

flexera

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferClass

Data version

5.1

Document digest

1e62afe9cda00e4c53cc94279884a3b3ae3c41133761863019ddd72fd4536dbb

05 Affected products

VendorProductVersionsPlatforms

redhatenterprise_linuxNot specified—

xpdfxpdfNot specified—

06 References

secunia.com27579http://secunia.com/advisories/27579third-party-advisoryx_refsource_SECUNIA
www.novell.comSUSE-SA:2007:060http://www.novell.com/linux/security/advisories/2007_60_pdf.htmlvendor-advisoryx_refsource_SUSE
secunia.com27632http://secunia.com/advisories/27632third-party-advisoryx_refsource_SECUNIA
secunia.com27743http://secunia.com/advisories/27743third-party-advisoryx_refsource_SECUNIA
www.mandriva.comMDKSA-2007:222http://www.mandriva.com/security/advisories?name=MDKSA-2007:222vendor-advisoryx_refsource_MANDRIVA
www.vupen.comADV-2007-3774http://www.vupen.com/english/advisories/2007/3774vdb-entryx_refsource_VUPEN
exchange.xforce.ibmcloud.comxpdf-ccittfaxstreamlookchar-bo(38304)https://exchange.xforce.ibmcloud.com/vulnerabilities/38304vdb-entryx_refsource_XF
secunia.com27260http://secunia.com/advisories/27260third-party-advisoryx_refsource_SECUNIA
secunia.com27856http://secunia.com/advisories/27856third-party-advisoryx_refsource_SECUNIA
support.novell.comhttp://support.novell.com/techcenter/psdb/da3498f05433976cc548cc4eaf8349c8.htmlx_refsource_CONFIRM
secunia.com27636http://secunia.com/advisories/27636third-party-advisoryx_refsource_SECUNIA
secunia.com29604http://secunia.com/advisories/29604third-party-advisoryx_refsource_SECUNIA
www.mandriva.comMDKSA-2007:223http://www.mandriva.com/security/advisories?name=MDKSA-2007:223vendor-advisoryx_refsource_MANDRIVA
secunia.com27721http://secunia.com/advisories/27721third-party-advisoryx_refsource_SECUNIA
secunia.com27724http://secunia.com/advisories/27724third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2007-3776http://www.vupen.com/english/advisories/2007/3776vdb-entryx_refsource_VUPEN
www.redhat.comFEDORA-2007-3059https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00224.htmlvendor-advisoryx_refsource_FEDORA
secunia.com27577http://secunia.com/advisories/27577third-party-advisoryx_refsource_SECUNIA
secunia.com29104http://secunia.com/advisories/29104third-party-advisoryx_refsource_SECUNIA
www.redhat.comFEDORA-2007-3031https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00215.htmlvendor-advisoryx_refsource_FEDORA
oval.cisecurity.orgoval:org.mitre.oval:def:9839https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9839vdb-entrysignaturex_refsource_OVAL
secunia.com27618http://secunia.com/advisories/27618third-party-advisoryx_refsource_SECUNIA
secunia.com27642http://secunia.com/advisories/27642third-party-advisoryx_refsource_SECUNIA
www.redhat.comFEDORA-2007-4031https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00369.htmlvendor-advisoryx_refsource_FEDORA
secunia.com27656http://secunia.com/advisories/27656third-party-advisoryx_refsource_SECUNIA
secunia.comhttp://secunia.com/secunia_research/2007-88/advisory/x_refsource_MISC
www.redhat.comFEDORA-2007-3100https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00238.htmlvendor-advisoryx_refsource_FEDORA
support.novell.comhttp://support.novell.com/techcenter/psdb/1d5fd29802b2ef7e342e733731f1e933.htmlx_refsource_CONFIRM
www.redhat.comRHSA-2007:1026http://www.redhat.com/support/errata/RHSA-2007-1026.htmlvendor-advisoryx_refsource_REDHAT
www.debian.orgDSA-1509http://www.debian.org/security/2008/dsa-1509vendor-advisoryx_refsource_DEBIAN
www.redhat.comRHSA-2007:1022http://www.redhat.com/support/errata/RHSA-2007-1022.htmlvendor-advisoryx_refsource_REDHAT
secunia.com27573http://secunia.com/advisories/27573third-party-advisoryx_refsource_SECUNIA
www.redhat.comRHSA-2007:1029http://www.redhat.com/support/errata/RHSA-2007-1029.htmlvendor-advisoryx_refsource_REDHAT
secunia.com27641http://secunia.com/advisories/27641third-party-advisoryx_refsource_SECUNIA
security.gentoo.orgGLSA-200805-13http://security.gentoo.org/glsa/glsa-200805-13.xmlvendor-advisoryx_refsource_GENTOO
secunia.com28812http://secunia.com/advisories/28812third-party-advisoryx_refsource_SECUNIA
www.debian.orgDSA-1537http://www.debian.org/security/2008/dsa-1537vendor-advisoryx_refsource_DEBIAN
www.redhat.comFEDORA-2007-750https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00724.htmlvendor-advisoryx_refsource_FEDORA
www.redhat.comRHSA-2007:1031http://www.redhat.com/support/errata/RHSA-2007-1031.htmlvendor-advisoryx_refsource_REDHAT
support.avaya.comhttp://support.avaya.com/elmodocs2/security/ASA-2007-476.htmx_refsource_CONFIRM
secunia.com27772http://secunia.com/advisories/27772third-party-advisoryx_refsource_SECUNIA
slackware.comSSA:2007-316-01http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.761882vendor-advisoryx_refsource_SLACKWARE
www.securityfocus.com26367http://www.securityfocus.com/bid/26367vdb-entryx_refsource_BID
secunia.com27615http://secunia.com/advisories/27615third-party-advisoryx_refsource_SECUNIA
www.redhat.comRHSA-2007:1021http://www.redhat.com/support/errata/RHSA-2007-1021.htmlvendor-advisoryx_refsource_REDHAT
www.vupen.comADV-2007-3786http://www.vupen.com/english/advisories/2007/3786vdb-entryx_refsource_VUPEN
secunia.com27645http://secunia.com/advisories/27645third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com20071107 Secunia Research: Xpdf "Stream.cc" Multiple Vulnerabilitieshttp://www.securityfocus.com/archive/1/483372mailing-listx_refsource_BUGTRAQ
secunia.com30168http://secunia.com/advisories/30168third-party-advisoryx_refsource_SECUNIA
secunia.com27574http://secunia.com/advisories/27574third-party-advisoryx_refsource_SECUNIA
issues.rpath.comhttps://issues.rpath.com/browse/RPL-1926x_refsource_CONFIRM
secunia.com26503http://secunia.com/advisories/26503third-party-advisoryx_refsource_SECUNIA
www.mandriva.comMDKSA-2007:219http://www.mandriva.com/security/advisories?name=MDKSA-2007:219vendor-advisoryx_refsource_MANDRIVA
www.debian.orgDSA-1480http://www.debian.org/security/2008/dsa-1480vendor-advisoryx_refsource_DEBIAN
security.gentoo.orgGLSA-200711-22http://security.gentoo.org/glsa/glsa-200711-22.xmlvendor-advisoryx_refsource_GENTOO
secunia.com27634http://secunia.com/advisories/27634third-party-advisoryx_refsource_SECUNIA
www.mandriva.comMDKSA-2007:227http://www.mandriva.com/security/advisories?name=MDKSA-2007:227vendor-advisoryx_refsource_MANDRIVA
www.kde.orghttp://www.kde.org/info/security/advisory-20071107-1.txtx_refsource_CONFIRM
secunia.com28043http://secunia.com/advisories/28043third-party-advisoryx_refsource_SECUNIA
secunia.com27619http://secunia.com/advisories/27619third-party-advisoryx_refsource_SECUNIA
www.mandriva.comMDKSA-2007:220http://www.mandriva.com/security/advisories?name=MDKSA-2007:220vendor-advisoryx_refsource_MANDRIVA
secunia.com27705http://secunia.com/advisories/27705third-party-advisoryx_refsource_SECUNIA
secunia.com27578http://secunia.com/advisories/27578third-party-advisoryx_refsource_SECUNIA
secunia.com27640http://secunia.com/advisories/27640third-party-advisoryx_refsource_SECUNIA
support.novell.comhttp://support.novell.com/techcenter/psdb/43ad7b3569dba59e7ba07677edc01cad.htmlx_refsource_CONFIRM
www.redhat.comRHSA-2007:1023http://www.redhat.com/support/errata/RHSA-2007-1023.htmlvendor-advisoryx_refsource_REDHAT
support.novell.comhttp://support.novell.com/techcenter/psdb/3867a5092daac43cd6a92e6107d9fbce.htmlx_refsource_CONFIRM
secunia.com27718http://secunia.com/advisories/27718third-party-advisoryx_refsource_SECUNIA
security.gentoo.orgGLSA-200711-34http://security.gentoo.org/glsa/glsa-200711-34.xmlvendor-advisoryx_refsource_GENTOO
secunia.com27599http://secunia.com/advisories/27599third-party-advisoryx_refsource_SECUNIA
secunia.com27575http://secunia.com/advisories/27575third-party-advisoryx_refsource_SECUNIA
www.redhat.comRHSA-2007:1028http://www.redhat.com/support/errata/RHSA-2007-1028.htmlvendor-advisoryx_refsource_REDHAT
www.securitytracker.com1018905http://www.securitytracker.com/id?1018905vdb-entryx_refsource_SECTRACK
support.novell.comhttp://support.novell.com/techcenter/psdb/f83e024a65d69ebc810d2117815b940d.htmlx_refsource_CONFIRM
www.redhat.comFEDORA-2007-3390https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00663.htmlvendor-advisoryx_refsource_FEDORA
www.mandriva.comMDKSA-2007:228http://www.mandriva.com/security/advisories?name=MDKSA-2007:228vendor-advisoryx_refsource_MANDRIVA
www.vupen.comADV-2007-3775http://www.vupen.com/english/advisories/2007/3775vdb-entryx_refsource_VUPEN
www.redhat.comRHSA-2007:1027http://www.redhat.com/support/errata/RHSA-2007-1027.htmlvendor-advisoryx_refsource_REDHAT
www.redhat.comRHSA-2007:1030http://www.redhat.com/support/errata/RHSA-2007-1030.htmlvendor-advisoryx_refsource_REDHAT
www.ubuntu.comUSN-542-1http://www.ubuntu.com/usn/usn-542-1vendor-advisoryx_refsource_UBUNTU
secunia.com27658http://secunia.com/advisories/27658third-party-advisoryx_refsource_SECUNIA
www.redhat.comRHSA-2007:1024http://www.redhat.com/support/errata/RHSA-2007-1024.htmlvendor-advisoryx_refsource_REDHAT
www.mandriva.comMDKSA-2007:230http://www.mandriva.com/security/advisories?name=MDKSA-2007:230vendor-advisoryx_refsource_MANDRIVA
www.ubuntu.comUSN-542-2http://www.ubuntu.com/usn/usn-542-2vendor-advisoryx_refsource_UBUNTU
www.redhat.comRHSA-2007:1025http://www.redhat.com/support/errata/RHSA-2007-1025.htmlvendor-advisoryx_refsource_REDHAT
www.vupen.comADV-2007-3779http://www.vupen.com/english/advisories/2007/3779vdb-entryx_refsource_VUPEN
www.debian.orgDSA-1408http://www.debian.org/security/2007/dsa-1408vendor-advisoryx_refsource_DEBIAN
www.redhat.comRHSA-2007:1051http://www.redhat.com/support/errata/RHSA-2007-1051.htmlvendor-advisoryx_refsource_REDHAT
www.mandriva.comMDKSA-2007:221http://www.mandriva.com/security/advisories?name=MDKSA-2007:221vendor-advisoryx_refsource_MANDRIVA
secunia.com27553http://secunia.com/advisories/27553third-party-advisoryx_refsource_SECUNIA
secunia.com27637http://secunia.com/advisories/27637third-party-advisoryx_refsource_SECUNIA

01 Record index

CVE-2007-5393

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2007-5393

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References