Multiple security vulnerabilities in the Solaris Gnome PDF Document Viewer (gpdf(1)) may allow a local or remote unprivileged user to cause the PDF Document Viewer application to crash or hang (potentially consuming excessive amounts of disk space, which may affect system performance), or may allow that user to execute arbitrary code with the privileges of the user opening a specially crafted PDF document with gpdf(1). The ability to crash or hang the gpdf(1) application or to cause it to consume excess disk space, are all types of Denial of Service (DoS).

These issues are also referenced in the following documents:

• CVE-2005-3191 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3191
• CVE-2005-3192 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3192
• CVE-2005-3193 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193
• CVE-2005-3624 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624
• CVE-2005-3625 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3625
• CVE-2005-3626 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626
• CVE-2005-3627 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627
• CVE-2005-2097 at: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2097

These issues can occur in the following releases:

SPARC Platform

• Solaris 10 without patch 120739-04

x86 Platform

• Solaris 10 without patch 120740-04

Note: Solaris 9 and Solaris 8 do not ship Gnome PDF Viewer and are not affected by these issues.

These issues only occur in Gnome PDF Viewer version 0.132 or earlier. To determine the version of gpdf(1) installed on the system, the following command can be run:

    $ gpdf --version
    Gnome gpdf 0.132

Due to these vulnerabilities, the GNOME PDF Viewer may crash or hang (potentially consuming excessive disk space) while opening certain PDF documents.

There are no predictable symptoms to indicate that these issues have been exploited to execute arbitrary code.

Until the resolution patches can be applied, it may be possible to work around the described issues by not opening untrusted PDF files with the GNOME PDF Viewer.

This issue is addressed in the following releases:

SPARC Platform

• Solaris 10 with patch 120739-04 or later

x86 Platform

• Solaris 10 with patch 120740-04 or later

• State: Resolved
• Updated Contributing Factors and Resolution sections

This solution has no attachment