Bug 184307

Summary:	CVE-2006-0746 kpdf buffer overflow
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	kdegraphics	Assignee:	Than Ngo <than>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	medium
Version:	4.0	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=important,public=20060103,reported=20060307,source=vendorsec
Fixed In Version:	RHSA-2006-0262	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-03-09 20:47:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2006-03-07 22:25:18 UTC

The initial fix for CVE-2005-3627 was incomplete in kdegraphics.

The complete patch is attachment 125771 [details]
The reproducer is attachment 125772 [details]

Here is Chris Evans' original advisory, it has links to various other bad pdf files:
http://scary.beasts.org/security/CESA-2005-003.txt

Comment 1 Than Ngo 2006-03-08 17:08:39 UTC

it's now fixed in kdegraphics-3.3.1-3.9

Comment 4 Red Hat Bugzilla 2006-03-09 20:47:37 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0262.html