[SECURITY] [DSA 1008-1] New kpdf packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1008-1 [email protected] http://www.debian.org/security/ Martin Schulze March 17th, 2006 http://www.debian.org/security/faq -...

DSA-1008-1 kpdf - buffer overflow

Bulletin has no description...

[KDE Security Advisory] kpdf of KDE 3.3.x heap based buffer overflow

KDE Security Advisory: kpdf/xpdf heap based buffer overflow Original Release Date: 2006-03-10 URL: http://www.kde.org/info/security/advisory-20060202-1.txt 0. References CVE-2006-0746 1. Systems affected: KDE 3.3.2 with patch from CVE-2005-3627 applied. Please note that the patch for KDE 3.4.x an...

[slackware-security] kdelibs

New kdelibs packages are available for Slackware 10.0, 10.1, and 10.2 to fix a security issue with kjs. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2006-0019 Additional information may be found on the KDE website...

[slackware-security] kdegraphics

New kdegraphics packages are available for Slackware 10.0, 10.1, 10.2, and -current to fix security issues with kpdf. More details about these issues may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2005-3191 https://vulners.com/cve/CVE-2005-3192...

Important: Red Hat Security Advisory: kdegraphics security update

Updated kdegraphics packages that resolve a security issue in kpdf are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a pdf file viewer...

security flaw

Heap-based buffer overflow in Splash.cc in xpdf, as used in other products such as 1 poppler, 2 kdegraphics, 3 gpdf, 4 pdfkit.framework, and others, allows attackers to cause a denial of service and possibly execute arbitrary code via crafted splash images that produce certain values that exceed...

KPdf: Heap based overflow

Background KPdf is a KDE-based PDF viewer included in the kdegraphics package. Description KPdf includes Xpdf code to handle PDF files. Dirk Mueller discovered that the Xpdf code is vulnerable a heap based overflow in the splash rasterizer engine. Impact An attacker could entice a user to open a...

kpdf -- heap based buffer overflow

The KDE team reports: kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains a heap based buffer overflow in the splash rasterizer engine that can crash kpdf or even execute arbitrary code...

GLSA-200601-11 : KDE kjs: URI heap overflow vulnerability

The remote host is affected by the vulnerability described in GLSA-200601-11 KDE kjs: URI heap overflow vulnerability Maksim Orlovich discovered an incorrect bounds check in kjs when handling URIs. Impact : By enticing a user to load a specially crafted webpage containing malicious JavaScript, an...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2006:019)

A heap overflow vulnerability was discovered in kjs, the KDE JavaScript interpretter engine. An attacker could create a malicious web site that contained carefully crafted JavaScript code that could trigger the flaw and potentially lead to the arbitrary execution of code as the user visiting the...

KDE libraries / Konqueror buffer overflow

Buffer overflow on Unicode URL parsing within JavaScript processor...

KDE kjs: URI heap overflow vulnerability

Background KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. kjs is the javascript interpreter used in Konqueror and other parts of KDE. Description Maksim Orlovich discovered an incorrect bounds check in kjs when handling URIs. Impact By enticing a us...

[KDE Security Advisory] kjs encodeuri/decodeuri heap overflow

KDE Security Advisory: kjs encodeuri/decodeuri heap overflow vulnerability Original Release Date: 2006-01-19 URL: http://www.kde.org/info/security/advisory-20060119-1.txt 0. References CVE-2006-0019 1. Systems affected: KDE 3.2.0 up to including KDE 3.5.0 2. Overview: Maksim Orlovich discovered a...

Fedora Core 4 : kdelibs-3.5.0-0.4.fc4 (2006-050)

A heap overflow flaw was discovered affecting kjs, the JavaScript interpreter engine used by Konqueror and other parts of KDE. An attacker could create a malicious website containing carefully crafted JavaScript code that would trigger this flaw and possibly lead to arbitrary code execution. The...

Ubuntu 5.04 / 5.10 : kdegraphics, koffice vulnerabilities (USN-236-2)

USN-236-1 fixed several vulnerabilities in xpdf. kpdf and kword contain copies of xpdf code and are thus vulnerable to the same issues. For reference, this is the original advisory : Chris Evans discovered several integer overflows in the XPDF code, which is present in xpdf, the Poppler library,...

Heap overflow

Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI...

CVE-2006-0019

Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI...

CVE-2006-0019

CVE-2006-0019 affects KDE kdelibs/kjs (KDE 3.2.0–3.5.0). The vulnerability is a heap-based overflow in encodeURI/decodeURI when parsing UTF-8 URIs, allowing remote code execution. CVSS v2 base 7.5 (NETWORK, LOW complexity, no auth). OpenVAS and vendor advisories (Debian DSA-948-1; Gentoo GLSA 200...

USN-245-1: KDE library vulnerability

Maksim Orlovich discovered that kjs, the Javascript interpreter engine used by Konqueror and other parts of KDE, did not sufficiently verify the validity of UTF-8 encoded URIs. Specially crafted URIs could trigger a buffer overflow. By tricking an user into visiting a web site with malicious...