KDE Security Advisory: kpdf/xpdf heap based buffer overflow Original Release Date: 2006-03-10 URL: http://www.kde.org/info/security/advisory-20060202-1.txt 0. References CVE-2006-0746 1. Systems affected: KDE 3.3.2 with patch from CVE-2005-3627 applied. Please note that the patch for KDE 3.4.x and newer was correct and is unaffected. 2. Overview: kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains multiple vulnerabilities, one of them being CVE-2005-3627, that was patched in the KDE security advisory 20051207-2. However, the patch published for KDE 3.3.x was faulty and only partially fixed the vulnerability. We'd like to thank Marcelo Ricardo Leitner for bringing this error to our attention. The Common Vulnerabilities and Exposures project has assigned CVE-2006-0746 to this issue. 3. Impact: Remotely supplied pdf files can be used to execute arbitrary code on the client machine. 4. Solution: Source code patches have been made available which fix these vulnerabilities. Contact your OS vendor / binary package provider for information about how to obtain updated binary packages. 5. Patch: Patch for KDE 3.3.2 and newer is available from ftp://ftp.kde.org/pub/kde/security_patches : ea346b89a3b39915abbfd56841b9df23 post-3.3.2-kdegraphics-CVE-2006-0746.diff -- Dirk//-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQBEEYk/vsXr+iuy1UoRApcSAKCp8tSRzja9XlXgFjqrnhOFG2d+aACdFeOX aAjpOeuOJEbb5BVEeg2O6Q4= =Zd0t -----END PGP SIGNATURE-----