lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <200601192307.14335.mueller@kde.org>
Date: Thu, 19 Jan 2006 23:07:10 +0100
From: Dirk Mueller <mueller@....org>
To: kde-announce@....org
Cc: bugtraq@...urityfocus.com
Subject: [KDE Security Advisory] kjs encodeuri/decodeuri heap
	overflow


KDE Security Advisory: kjs encodeuri/decodeuri heap overflow vulnerability
Original Release Date: 2006-01-19
URL: http://www.kde.org/info/security/advisory-20060119-1.txt

0. References
        CVE-2006-0019


1. Systems affected:

        KDE 3.2.0 up to including KDE 3.5.0


2. Overview:

        Maksim Orlovich discovered an incorrect bounds check in kjs,
        the JavaScript interpreter engine used by Konqueror and other
        parts of KDE, that allows a heap based buffer overflow
        when decoding specially crafted UTF-8 encoded URI sequences.


3. Impact:

        Remotely supplied Javascript code can perform a heap overflow
        and crash the web browser or execute arbitrary code.


4. Solution:

        Source code patches have been made available which fix these
        vulnerabilities. Contact your OS vendor / binary package provider
        for information about how to obtain updated binary packages.


5. Patch:

        Patch for KDE 3.4.0 - 3.5.0 is available from 
        ftp://ftp.kde.org/pub/kde/security_patches :

        ecc0ec13ce3b06e94e35aa8e937e02bf  post-3.4.3-kdelibs-kjs.diff

        Patch for KDE 3.2.0 - 3.3.2 is available from 
        ftp://ftp.kde.org/pub/kde/security_patches :

        9bca9b44ca2d84e3b2f85ffb5d30e047  post-3.2.3-kdelibs-kjs.diff


Content of type "application/pgp-signature" skipped

_______________________________________________
kde-announce mailing list
kde-announce@....org
https://mail.kde.org/mailman/listinfo/kde-announce

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ