Bug 184308

Summary:	CVE-2006-0746 kpdf buffer overflow
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	kdegraphics	Assignee:	Than Ngo <than>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	medium
Version:	4	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=important,public=20060103,reported=20060307,source=vendorsec
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-03-10 15:35:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2006-03-07 22:27:34 UTC

+++ This bug was initially created as a clone of Bug #184307 +++

The initial fix for CVE-2005-3627 was incomplete in kdegraphics.

The complete patch is attachment 125771 [details]
The reproducer is attachment 125772 [details]

Here is Chris Evans' original advisory, it has links to various other bad pdf files:
http://scary.beasts.org/security/CESA-2005-003.txt

Comment 1 Than Ngo 2006-03-10 15:35:12 UTC

there's kde-3.5.1 in FC4-update. It's not effected in this new kde version

http://www.kde.org/info/security/advisory-20060202-1.txt