Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 3 product line. The current stable release is 3.9. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 113007

Summary: CAN-2003-0988 kdepim VCF parsing vulnerability
Product: Red Hat Enterprise Linux 3 Reporter: Mark J. Cox <mjc>
Component: kdepimAssignee: Than Ngo <than>
Status: CLOSED ERRATA QA Contact: Ben Levenson <benl>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.0Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-01-14 14:46:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mark J. Cox 2004-01-07 10:05:24 UTC 
The KDE team found a buffer overflow in the file information reader of
VCF files. An attacker could construct a VCF file so that when it was
opened by a victim it would execute arbitrary commands. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2003-0988 to this issue.

        CAN-2003-0988 Affects: 3AS 3ES 3WS 

Note the kdepim packages in RHEL 2.1 are not affected by this issue.

RHSA-2004:005 will provide updated packages with a backported security
patch.

This issue is under embargo and will be opened on January 14th 2004.
Comment 1 Mark J. Cox 2004-01-14 14:46:39 UTC 
Fixed, see http://rhn.redhat.com/errata/RHSA-2004-005.html