blob: d1bd0585f50344a9bc6a994665df07566cdb58ea [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200412-17">
<title>kfax: Multiple overflows in the included TIFF library</title>
kfax contains several buffer overflows potentially leading to execution of
arbitrary code.
<product type="ebuild">kfax</product>
<announced>December 19, 2004</announced>
<revised>January 12, 2005: 04</revised>
<package name="kde-base/kdegraphics" auto="yes" arch="*">
<unaffected range="ge">3.3.2</unaffected>
<vulnerable range="lt">3.3.2</vulnerable>
KDE is a feature-rich graphical desktop environment for Linux and
Unix-like Operating Systems. kfax (part of kdegraphics) is the KDE fax
file viewer.
Than Ngo discovered that kfax contains a private copy of the TIFF
library and is therefore subject to several known vulnerabilities (see
<impact type="normal">
A remote attacker could entice a user to view a carefully-crafted TIFF
image file with kfax, which would potentially lead to execution of
arbitrary code with the rights of the user running kfax.
The KDE Team recommends to remove the kfax binary as well as the KPart:
rm /usr/kde/3.*/lib/kde3/
rm /usr/kde/3.*/bin/kfax</code>
Note: This will render the kfax functionality useless, if kfax
functionality is needed you should upgrade to the KDE 3.3.2 which is
not stable at the time of this writing.
There is no known workaround at this time.
All kfax users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=kde-base/kdegraphics-3.3.2&quot;</code>
<uri link="">KDE Security Advisory: kfax libtiff vulnerabilities</uri>
<uri link="/security/en/glsa/glsa-200410-11.xml">GLSA 200410-11</uri>
<uri link="">CAN-2004-0803</uri>
<uri link="">CAN-2004-0804</uri>
<uri link="">CAN-2004-0886</uri>
<metadata tag="submitter" timestamp="Fri, 10 Dec 2004 09:35:12 +0000">
<metadata tag="bugReady" timestamp="Sun, 19 Dec 2004 16:51:18 +0000">