bugtraq - [KDE Security Advisory] kpdf of KDE 3.3.x heap based buffer overflow

Open Source and information security mailing list archives

Message-ID: <200603101512.15931.mueller@kde.org>
Date: Fri, 10 Mar 2006 15:12:12 +0100
From: Dirk Mueller <mueller@....org>
To: kde-announce@....org
Cc: security@....org, kde-packager@....org, bugtraq@...urityfocus.com
Subject: [KDE Security Advisory] kpdf of KDE 3.3.x heap based
	buffer overflow


KDE Security Advisory: kpdf/xpdf heap based buffer overflow
Original Release Date: 2006-03-10
URL: http://www.kde.org/info/security/advisory-20060202-1.txt

0. References
        CVE-2006-0746


1. Systems affected:

        KDE 3.3.2 with patch from CVE-2005-3627 applied. Please
        note that the patch for KDE 3.4.x and newer was correct and
        is unaffected.


2. Overview:

        kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
        multiple vulnerabilities, one of them being CVE-2005-3627,
        that was patched in the KDE security advisory 20051207-2.
        However, the patch published for KDE 3.3.x was faulty and
        only partially fixed the vulnerability. We'd like to thank
        Marcelo Ricardo Leitner for bringing this error to our attention.
        The Common Vulnerabilities and Exposures project has assigned
        CVE-2006-0746 to this issue.


3. Impact:

        Remotely supplied pdf files can be used to execute arbitrary
        code on the client machine.


4. Solution:

        Source code patches have been made available which fix these
        vulnerabilities. Contact your OS vendor / binary package provider
        for information about how to obtain updated binary packages.


5. Patch:

        Patch for KDE 3.3.2 and newer is available from 
        ftp://ftp.kde.org/pub/kde/security_patches :

	ea346b89a3b39915abbfd56841b9df23  post-3.3.2-kdegraphics-CVE-2006-0746.diff


-- 
Dirk//\

Content of type "application/pgp-signature" skipped

_______________________________________________
kde-announce mailing list
kde-announce@....org
https://mail.kde.org/mailman/listinfo/kde-announce

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives