CVE-2004-1125: easy_software_products cups Improper Input Validation
- 2 references with an unsupported link type were hidden.
Vulnerability summary
CVE-2004-1125 is a high (CVSS 9.3) Improper Input Validation vulnerability in easy_software_products cups. EPSS estimates a 6.58% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7Timeline
- 22-12-2004PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, and other products that share code such as tetex-bin and kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PDF file that causes the boundaries of a maskColors array to be exceeded.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.58%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
0.00 pp
From 6.58% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian3 products
- cups< 1.1.22-2
- cupsys< 1.1.14-5woody11
- xpdf< 3.00-11 | < 1.00-3.3
Redhat2 products
- xpdf< 1:2.02-9.4
- xpdf-debuginfo< 1:2.02-9.4
Easy_software_products1 product
- cups1.1.20
Kde1 product
- kde3.2.3 | 3.3.2
Xpdf1 product
- xpdf3.0
5 vendors · 8 products
References
34 links- www.kde.org/info/security/advisory-20041223-1.txtX Refsource CONFIRM
Show all 34 references
- lists.grok.org.uk/pipermail/full-disclosure/2004-December/030241.htmlMailing ListX Refsource FULLDISC
- www.idefense.com/application/poi/display?id=172&type=vulnerabilitiesThird Party AdvisoryX Refsource IDEFENSE
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10830VDB EntrySignatureX Refsource OVAL
