KDE Security Advisory: KWord RTF import buffer overflow Original Release Date: 2005-10-11 URL: http://www.kde.org/info/security/advisory-20051011-1.txt
All KOffice releases starting from KOffice 1.2.0 up to including KOffice 1.4.1.
Chris Evans reported a heap based buffer overflow in the RTF importer of KWord.
Opening specially crafted RTF files in KWord can cause execution of abitrary code.
Source code patches have been made available which fix these vulnerabilities. Contact your OS vendor / binary package provider for information about how to obtain updated binary packages.
Patch for KOffice 1.4.1 is available from ftp://ftp.kde.org/pub/kde/security_patches : 9f77b327119fd1db0752dab785e2a975 post-koffice-1.4.1-rtfimport.diff Patch for KOffice 1.3.5 is available from ftp://ftp.kde.org/pub/kde/security_patches : 71a1baa8244dbcc1bfc2bd3c3e3dd40f post-koffice-1.3.5-rtfimport.diff Patch for KOffice 1.2.1 is available from ftp://ftp.kde.org/pub/kde/security_patches : b36488a186aded0f5e812397af3c689a post-koffice-1.2.1-rtfimport.diff