CVE-2005-0064
UnknownEPSS 7.22%
Last modified
CVE-2005-0064 is a vulnerability of currently unknown severity. Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.. EPSS estimates a 7.22% chance of exploitation in the next 30 days.
Description
Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Xpdf | Xpdf | 0.2 |
| Xpdf | Xpdf | 0.3 |
| Xpdf | Xpdf | 0.4 |
| Xpdf | Xpdf | 0.5 |
| Xpdf | Xpdf | 0.5a |
| Xpdf | Xpdf | 0.6 |
| Xpdf | Xpdf | 0.7 |
| Xpdf | Xpdf | 0.7a |
| Xpdf | Xpdf | 0.80 |
| Xpdf | Xpdf | 0.90 |
| Xpdf | Xpdf | 0.91 |
| Xpdf | Xpdf | 0.91a |
| Xpdf | Xpdf | 0.91b |
| Xpdf | Xpdf | 0.91c |
| Xpdf | Xpdf | 0.92 |
| Xpdf | Xpdf | 0.92a |
| Xpdf | Xpdf | 0.92b |
| Xpdf | Xpdf | 0.92c |
| Xpdf | Xpdf | 0.92d |
| Xpdf | Xpdf | 0.92e |
| Xpdf | Xpdf | 0.93 |
| Xpdf | Xpdf | 0.93a |
| Xpdf | Xpdf | 0.93b |
| Xpdf | Xpdf | 0.93c |
| Xpdf | Xpdf | 1.0 |
| Xpdf | Xpdf | 1.0a |
| Xpdf | Xpdf | 1.1 |
| Xpdf | Xpdf | 2.0 |
| Xpdf | Xpdf | 2.1 |
| Xpdf | Xpdf | 2.2 |
| Xpdf | Xpdf | 2.3 |
| Xpdf | Xpdf | 3.0 |
References
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000921Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-645Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-648Patch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=186&type=vulnerabilitiesExploit, Patch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-034.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-053.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-057.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-059.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-066.htmlPatch, Vendor Advisory
- http://www.trustix.org/errata/2005/0003/Patch, Vendor Advisory
- https://bugzilla.fedora.us/show_bug.cgi?id=2352Patch, Vendor Advisory
- https://bugzilla.fedora.us/show_bug.cgi?id=2353Patch, Vendor Advisory
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000921Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-645Patch, Vendor Advisory
- http://www.debian.org/security/2005/dsa-648Patch, Vendor Advisory
- http://www.idefense.com/application/poi/display?id=186&type=vulnerabilitiesExploit, Patch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-034.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-053.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-057.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-059.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2005-066.htmlPatch, Vendor Advisory
- http://www.trustix.org/errata/2005/0003/Patch, Vendor Advisory
- https://bugzilla.fedora.us/show_bug.cgi?id=2352Patch, Vendor Advisory
- https://bugzilla.fedora.us/show_bug.cgi?id=2353Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2005-0064?
Buffer overflow in the Decrypt::makeFileKey2 function in Decrypt.cc for xpdf 3.00 and earlier allows remote attackers to execute arbitrary code via a PDF file with a large /Encrypt /Length keyLength value.
How severe is CVE-2005-0064?
Severity scoring for CVE-2005-0064 is pending analysis. The EPSS model estimates a 7.22% probability of exploitation in the next 30 days.
How do I fix CVE-2005-0064?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2005
- CVE-2005-0057The Hyperlink Object Library for Windows 98, 2000, XP, and S…
- CVE-2005-0058Buffer overflow in the Telephony Application Programming Int…
- CVE-2005-0059Buffer overflow in the Message Queuing component of Microsof…
- CVE-2005-0060Buffer overflow in the font processing component of Microsof…
- CVE-2005-0061The kernel of Microsoft Windows 2000, Windows XP SP1 and SP2…
- CVE-2005-0063The document processing application used by the Windows Shel…
- CVE-2005-0065The original design of TCP does not check that the TCP seque…
- CVE-2005-0066The original design of TCP does not check that the TCP Ackno…
- CVE-2005-0067The original design of TCP does not require that port number…
- CVE-2005-0068The original design of ICMP does not require authentication …
- CVE-2005-0069The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow …
- CVE-2005-0070Synaesthesia 2.1 and earlier, and possibly other versions, w…
Are you affected by CVE-2005-0064?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST