CVE-2007-0104: kde Improper Input Validation

CVSS: 6.8v2.0MediumModified

AliasesDEBIAN-CVE-2007-0104

Published 09-01-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-0104 is a medium (CVSS 6.8) Improper Input Validation vulnerability in kde. EPSS estimates a 6.23% chance of exploitation in the next 30 days, higher than 93.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

38/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

6.23%

0%100%

Low · +0.16 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 2

OPENSUSE-SU-2024:10707-1 OPENSUSE-SU-2024:11181-1

Timeline

09-01-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The Adobe PDF specification 1.3, as implemented by (a) xpdf 3.0.1 patch 2, (b) kpdf in KDE before 3.5.5, (c) poppler before 0.5.4, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

6.23%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

+0.16 pp

From 6.07% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.23%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Debian2 products

poppler< 0.4.5-5.1
xpdf< 3.02

Kde1 product

kde3.2 | 3.2.1 | 3.2.2 | 3.2.3 | 3.3 | 3.3.1 | 3.3.2 | 3.4 | 3.4.1 | 3.4.2 | 3.4.3 | 3.5

Xpdf1 product

xpdf3.0 | 3.0.1 | 3.0.1_pl1 | 3.0.1_pl2 | 3.0_pl2

3 vendors · 4 products

References

35 links

secunia.com/advisories/23815Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/security/advisories?name=MDKSA-2007:022Vendor AdvisoryX Refsource MANDRIVA
www.mandriva.com/security/advisories?name=MDKSA-2007:020Vendor AdvisoryX Refsource MANDRIVA
www.us-cert.gov/cas/techalerts/TA07-072A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
www.mandriva.com/security/advisories?name=MDKSA-2007:021Vendor AdvisoryX Refsource MANDRIVA
www.kde.org/info/security/advisory-20070115-1.txtX Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDKSA-2007:019Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/23799Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/23839Third Party AdvisoryX Refsource SECUNIAVendor Advisory
docs.info.apple.com/article.html?artnum=305214X Refsource CONFIRM

Show all 35 references

exchange.xforce.ibmcloud.com/vulnerabilities/31364VDB EntryX Refsource XF
www.ubuntu.com/usn/usn-410-2Vendor AdvisoryX Refsource UBUNTU
www.mandriva.com/security/advisories?name=MDKSA-2007:018Vendor AdvisoryX Refsource MANDRIVA
securitytracker.com/id?1017514VDB EntryX Refsource SECTRACK
secunia.com/advisories/23791Third Party AdvisoryX Refsource SECUNIA
www.novell.com/linux/security/advisories/2007_3_sr.htmlVendor AdvisoryX Refsource SUSE
support.novell.com/techcenter/psdb/44d7cb9b669d58e0ce5aa5d7ab2c7c53.htmlX Refsource CONFIRM
www.securityfocus.com/bid/21910VDB EntryX Refsource BIDExploit
www.mandriva.com/security/advisories?name=MDKSA-2007:024Vendor AdvisoryX Refsource MANDRIVA
www.securitytracker.com/id?1017749VDB EntryX Refsource SECTRACK
projects.info-pull.com/moab/MOAB-06-01-2007.htmlX Refsource MISC
secunia.com/advisories/23844Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.ubuntu.com/usn/usn-410-1Vendor AdvisoryX Refsource UBUNTU
www.vupen.com/english/advisories/2007/0203VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/23876Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/457055/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2007/0244VDB EntryX Refsource VUPENVendor Advisory
www.vupen.com/english/advisories/2007/0212VDB EntryX Refsource VUPENVendor Advisory
www.vupen.com/english/advisories/2007/0930VDB EntryX Refsource VUPENVendor Advisory
issues.rpath.com/browse/RPL-964X Refsource CONFIRM
secunia.com/advisories/23813Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/24204Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/23808Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/24479Third Party AdvisoryX Refsource SECUNIAVendor Advisory
security-tracker.debian.org/tracker/CVE-2007-0104Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities