CVE-2005-3625

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-31 · updated 2026-06-16
Weakness: CWE-399

Description

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

Affected products

Conectiva Linux: 10.0
Debian Linux: 3.0, 3.1
Easy Software Products Cups: 1.1.22, 1.1.22_rc1, 1.1.23, 1.1.23_rc1
gentoo Linux: all versions
Kdegraphics: 3.2, 3.4.3
KDE Koffice: 1.4, 1.4.1, 1.4.2
KDE Kpdf: 3.2, 3.4.3
KDE Kword: 1.4.2
Libextractor: all versions
Mandrakesoft Mandrake Linux: 10.1, 10.2, 2006
Mandrakesoft Mandrake Linux Corporate Server: 2.1, 3.0
Poppler: 0.4.2
Red Hat Enterprise Linux: 2.1, 3.0, 4.0
RedHat Enterprise Linux Desktop: 3.0, 4.0
RedHat Fedora Core: core_1.0, core_2.0, core_3.0, core_4.0
RedHat Linux: 7.3, 9.0
RedHat Linux Advanced Workstation: 2.1
Sco Openserver: 5.0.7, 6.0
Sgi Propack: 3.0-sp6
Slackware Linux: 9.0, 9.1, 10.0, 10.1, 10.2
Suse Linux: 1.0, 9.0, 9.1, 9.2, 9.3, 10.0
Tetex: 1.0.7, 2.0, 2.0.1, 2.0.2, 3.0
Trustix Secure Linux: 2.0, 2.2, 3.0
Turbolinux: 10, fuji
Turbolinux Appliance Server: 1.0_hosting_edition, 1.0_workgroup_edition
Turbolinux Desktop: 10.0
Turbolinux Home: all versions
Turbolinux Multimedia: all versions
Turbolinux Personal: all versions
Turbolinux Server: 8.0, 10.0, 10.0_x86

References

Get alerted when CVE-2005-3625 or the next vulnerability affects your stack