- ---------------------------------------------------------------------                   Red Hat Security Advisory

Synopsis:          Moderate: kdegraphics security update
Advisory ID:       RHSA-2006:0648-01
Advisory URL:      https://access.redhat.com/errata/RHSA-2006:0648.html
Issue date:        2006-08-28
Updated on:        2006-08-28
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-3459 CVE-2006-3460 CVE-2006-3461 
                   CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 
                   CVE-2006-3465 
- ---------------------------------------------------------------------1. Summary:

Updated kdegraphics packages that fix several security flaws in kfax are
now available for Red Hat Enterprise Linux 2.1, and 3.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

The kdegraphics package contains graphics applications for the K Desktop
Environment.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a
security audit.  The kfax application contains a copy of the libtiff code
used for parsing TIFF files and is therefore affected by these flaws.  
An attacker who has the ability to trick a user into opening a malicious
TIFF file could cause kfax to crash or possibly execute arbitrary code.
(CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463,
CVE-2006-3464, CVE-2006-3465)

Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses
the shared libtiff library which has been fixed in a previous update.

Users of kfax should upgrade to these updated packages, which contain
backported patches and are not vulnerable to this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

201313 - CVE-2006-3459 kfax affected by libtiff flaws (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

i386:
95b171e3e34fb770f40ca342201b8530  kdegraphics-2.2.2-4.4.i386.rpm
92d41638599ce40f99bd4dae53d4557d  kdegraphics-devel-2.2.2-4.4.i386.rpm

ia64:
b60111c884c0c11fe38c014fd2aa20a4  kdegraphics-2.2.2-4.4.ia64.rpm
8d3017d74b4c39ca38c6840127134b7d  kdegraphics-devel-2.2.2-4.4.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

ia64:
b60111c884c0c11fe38c014fd2aa20a4  kdegraphics-2.2.2-4.4.ia64.rpm
8d3017d74b4c39ca38c6840127134b7d  kdegraphics-devel-2.2.2-4.4.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

i386:
95b171e3e34fb770f40ca342201b8530  kdegraphics-2.2.2-4.4.i386.rpm
92d41638599ce40f99bd4dae53d4557d  kdegraphics-devel-2.2.2-4.4.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

i386:
95b171e3e34fb770f40ca342201b8530  kdegraphics-2.2.2-4.4.i386.rpm
92d41638599ce40f99bd4dae53d4557d  kdegraphics-devel-2.2.2-4.4.i386.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS:
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

ia64:
26bd834fd42ee5aeeab12cb1e7255f4f  kdegraphics-3.1.3-3.10.ia64.rpm
c1de4ef881ce270b2927afd8153b5d8e  kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm
7186b1f5ca78824f67b73cf9b83351d7  kdegraphics-devel-3.1.3-3.10.ia64.rpm

ppc:
9f6cdd9650db6608f972c42c76e8a4de  kdegraphics-3.1.3-3.10.ppc.rpm
966ce65766809c0839f90bc7ee319f6d  kdegraphics-debuginfo-3.1.3-3.10.ppc.rpm
b452e2ef7748b702aa75b10dcc33f17c  kdegraphics-devel-3.1.3-3.10.ppc.rpm

s390:
866768918b02cd3601a304a59d15ad51  kdegraphics-3.1.3-3.10.s390.rpm
ce2c5282ee6694998f105b322107489c  kdegraphics-debuginfo-3.1.3-3.10.s390.rpm
a3055e2cf71f6e7620a9c84a6058be7f  kdegraphics-devel-3.1.3-3.10.s390.rpm

s390x:
522c7089c601e9ed8d01e478503a795a  kdegraphics-3.1.3-3.10.s390x.rpm
e6e1f1c463c44748d85e1a073a96c30e  kdegraphics-debuginfo-3.1.3-3.10.s390x.rpm
893a3ad832cfdc2e65ec585536717ca0  kdegraphics-devel-3.1.3-3.10.s390x.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

ia64:
26bd834fd42ee5aeeab12cb1e7255f4f  kdegraphics-3.1.3-3.10.ia64.rpm
c1de4ef881ce270b2927afd8153b5d8e  kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm
7186b1f5ca78824f67b73cf9b83351d7  kdegraphics-devel-3.1.3-3.10.ia64.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

ia64:
26bd834fd42ee5aeeab12cb1e7255f4f  kdegraphics-3.1.3-3.10.ia64.rpm
c1de4ef881ce270b2927afd8153b5d8e  kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm
7186b1f5ca78824f67b73cf9b83351d7  kdegraphics-devel-3.1.3-3.10.ia64.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.

RedHat: Moderate: kdegraphics security update RHSA-2006:0648-01

Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3

Summary

The kdegraphics package contains graphics applications for the K Desktop Environment. Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465) Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update. Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
201313 - CVE-2006-3459 kfax affected by libtiff flaws (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS: 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm
i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm
ia64: b60111c884c0c11fe38c014fd2aa20a4 kdegraphics-2.2.2-4.4.ia64.rpm 8d3017d74b4c39ca38c6840127134b7d kdegraphics-devel-2.2.2-4.4.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS: 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm
ia64: b60111c884c0c11fe38c014fd2aa20a4 kdegraphics-2.2.2-4.4.ia64.rpm 8d3017d74b4c39ca38c6840127134b7d kdegraphics-devel-2.2.2-4.4.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS: 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm
i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS: 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm
i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm
Red Hat Enterprise Linux AS version 3:
SRPMS: ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm
i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm
ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm
ppc: 9f6cdd9650db6608f972c42c76e8a4de kdegraphics-3.1.3-3.10.ppc.rpm 966ce65766809c0839f90bc7ee319f6d kdegraphics-debuginfo-3.1.3-3.10.ppc.rpm b452e2ef7748b702aa75b10dcc33f17c kdegraphics-devel-3.1.3-3.10.ppc.rpm
s390: 866768918b02cd3601a304a59d15ad51 kdegraphics-3.1.3-3.10.s390.rpm ce2c5282ee6694998f105b322107489c kdegraphics-debuginfo-3.1.3-3.10.s390.rpm a3055e2cf71f6e7620a9c84a6058be7f kdegraphics-devel-3.1.3-3.10.s390.rpm
s390x: 522c7089c601e9ed8d01e478503a795a kdegraphics-3.1.3-3.10.s390x.rpm e6e1f1c463c44748d85e1a073a96c30e kdegraphics-debuginfo-3.1.3-3.10.s390x.rpm 893a3ad832cfdc2e65ec585536717ca0 kdegraphics-devel-3.1.3-3.10.s390x.rpm
x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm
Red Hat Desktop version 3:
SRPMS: ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm
i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm
x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS: ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm
i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm
ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm
x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS: ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm
i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm
ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm
x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465 http://www.redhat.com/security/updates/classification/#moderate

Package List

Severity

Advisory ID: RHSA-2006:0648-01

Advisory URL: https://access.redhat.com/errata/RHSA-2006:0648.html

Issued Date: : 2006-08-28

Updated on: 2006-08-28

Product: Red Hat Enterprise Linux

CVE Names: CVE-2006-3459 CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465 Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team.