bugtraq - [KOffice security advisory] KOffice OLEfilter integer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200612051149.11715.mueller@kde.org>
Date: Tue, 5 Dec 2006 11:49:11 +0100
From: Dirk Mueller <mueller@....org>
To: kde-announce@....org
Cc: bugtraq@...urityfocus.com
Subject: [KOffice security advisory] KOffice OLEfilter integer overflow


KOffice Security Advisory: KOffice olefilters integer overflow
Original Release Date: 2006-12-04
URL: http://www.kde.org/info/security/advisory-20061204-1.txt

0. References

        CVE-2006-6120

1. Systems affected:

        KOffice 1.4.x and 1.6.0. 1.5.x releases are unaffected as well
        as 1.6.1 or newer.

2. Overview:

        The OLE import filter, which is used in KPresenter to open Microsoft
        Powerpoint files is vulnerable to an integer overflow problem that
        can be exploited to expose an heap memory overflow.  This
        issue was reported by Kees Cook from Ubuntu security.

3. Impact:

        A maliciously crafted file can cause to execute arbitrary code.

4. Solution:

        Source code patches have been made available which fix these
        vulnerabilities. Contact your OS vendor / binary package provider
        fo information about how to obtain updated binary packages.


5. Patch:

        A patch for KOffice 1.4.0 - KOffice 1.6.0 is available from
        ftp://ftp.kde.org/pub/kde/security_patches :

        20dff20ccd2e184f1874aa60d85f4380  post-koffice-1.6.0.diff