CVE-2007-0104 Memory corruption in n/a
Remote attackers can trigger memory corruption or denial of service via crafted PDF files, affecting users of vulnerable PDF rendering libraries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2007-0104?
CVE-2007-0104 is a medium-severity memory corruption vulnerability in Kde Kde, published on 9 Jan 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.
Weakness: CWE-20
Which versions are affected by CVE-2007-0104?
It affects 2 products.
Products include Kde Kde, Xpdf Xpdf.
How do I fix CVE-2007-0104?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2007-0104 being exploited?
There is no known exploitation of CVE-2007-0104 in the wild and no public exploit code.
Other vulnerabilities in Kde Kde
Sources
Also known as DEBIAN-CVE-2007-0104, GHSA-8w95-hg52-rgm5.