[KDE Security Advisory] kpdf of KDE 3.3.x heap based buffer overflow

[Dirk Mueller <mueller@xxxxxxx>]

KDE Security Advisory: kpdf/xpdf heap based buffer overflow
Original Release Date: 2006-03-10
URL: http://www.kde.org/info/security/advisory-20060202-1.txt

0. References
        CVE-2006-0746


1. Systems affected:

        KDE 3.3.2 with patch from CVE-2005-3627 applied. Please
        note that the patch for KDE 3.4.x and newer was correct and
        is unaffected.


2. Overview:

        kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
        multiple vulnerabilities, one of them being CVE-2005-3627,
        that was patched in the KDE security advisory 20051207-2.
        However, the patch published for KDE 3.3.x was faulty and
        only partially fixed the vulnerability. We'd like to thank
        Marcelo Ricardo Leitner for bringing this error to our attention.
        The Common Vulnerabilities and Exposures project has assigned
        CVE-2006-0746 to this issue.


3. Impact:

        Remotely supplied pdf files can be used to execute arbitrary
        code on the client machine.


4. Solution:

        Source code patches have been made available which fix these
        vulnerabilities. Contact your OS vendor / binary package provider
        for information about how to obtain updated binary packages.


5. Patch:

        Patch for KDE 3.3.2 and newer is available from 
        ftp://ftp.kde.org/pub/kde/security_patches :

        ea346b89a3b39915abbfd56841b9df23  
post-3.3.2-kdegraphics-CVE-2006-0746.diff



-- 
Dirk//\

Attachment: pgpPC38x2WxSW.pgp
Description: PGP signature