---------------------------------------------------------------------Fedora Update Notification
FEDORA-2005-350
2005-05-02
---------------------------------------------------------------------Product     : Fedora Core 3
Name        : kdelibs
Version     : 3.3.1
Release     : 2.12.FC3
Summary     : K Desktop Environment - Libraries
Description :
Libraries for the K Desktop Environment:
KDE Libraries included: kdecore (KDE core library), kdeui (user interface),
kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking),
kspell (spelling checker), jscript (javascript), kab (addressbook),
kimgio (image manipulation).
---------------------------------------------------------------------Update Information:

A buffer overflow was found in the kimgio library for KDE 3.3.1. An
attacker could create a carefully crafted PCX image in such a way that it
would cause kimgio to execute arbitrary code when processing the image.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1046 to this issue.

All users of kdelibs should upgrade to these updated packages, which
contain a backported security patch to correct these issues.
---------------------------------------------------------------------* Tue Apr 19 2005 Than Ngo  6:3.3.1-2.12.FC3

- apply patch to fix gcc warning #117938

* Tue Apr 19 2005 Than Ngo  6:3.3.1-2.11.FC3

- add missing kde documents #152307
- apply patch to fix kimgio input validation vulnerabilities, CAN-2005-1046
- add hack for loading of *.so shared object files #142244

* Mon Apr 18 2005 Than Ngo  6:3.3.1-2.10.FC3

- backport the patch to fix kimgio input validation vulnerabilities,
  CAN-2005-1046, #152093, thanks to KDE security team


---------------------------------------------------------------------This update can be downloaded from:
  
1023f08e9573cd579ed4d978b8f7a7fb  SRPMS/kdelibs-3.3.1-2.12.FC3.src.rpm
be28a562a1d99f4530ac1866ab332199  x86_64/kdelibs-3.3.1-2.12.FC3.x86_64.rpm
784b411818c9a1a3d28811e814b9880a  
x86_64/kdelibs-devel-3.3.1-2.12.FC3.x86_64.rpm
c81fb52aa13551ffb233f9ecc9ea72df  
x86_64/debug/kdelibs-debuginfo-3.3.1-2.12.FC3.x86_64.rpm
0e6fdd04807160ee7571bcfb098d4c79  x86_64/kdelibs-3.3.1-2.12.FC3.i386.rpm
0e6fdd04807160ee7571bcfb098d4c79  i386/kdelibs-3.3.1-2.12.FC3.i386.rpm
f14c330fcc3f2c9618dc88550d4dd307  i386/kdelibs-devel-3.3.1-2.12.FC3.i386.rpm
bf6808e504ace10edb9da8b6f71efc5f  
i386/debug/kdelibs-debuginfo-3.3.1-2.12.FC3.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
-----------------------------------------------------------------------fedora-announce-list mailing list
fedora-announce-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list

Fedora Core 3 Update: kdelibs-3.3.1-2.12.FC3

May 2, 2005
A buffer overflow was found in the kimgio library for KDE 3.3.1

Summary

Libraries for the K Desktop Environment:

KDE Libraries included: kdecore (KDE core library), kdeui (user interface),

kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking),

kspell (spelling checker), jscript (javascript), kab (addressbook),

kimgio (image manipulation).

A buffer overflow was found in the kimgio library for KDE 3.3.1. An

attacker could create a carefully crafted PCX image in such a way that it

would cause kimgio to execute arbitrary code when processing the image.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has

assigned the name CAN-2005-1046 to this issue.

All users of kdelibs should upgrade to these updated packages, which

contain a backported security patch to correct these issues.

- apply patch to fix gcc warning #117938

* Tue Apr 19 2005 Than Ngo 6:3.3.1-2.11.FC3

- add missing kde documents #152307

- apply patch to fix kimgio input validation vulnerabilities, CAN-2005-1046

- add hack for loading of *.so shared object files #142244

* Mon Apr 18 2005 Than Ngo 6:3.3.1-2.10.FC3

- backport the patch to fix kimgio input validation vulnerabilities,

CAN-2005-1046, #152093, thanks to KDE security team

1023f08e9573cd579ed4d978b8f7a7fb SRPMS/kdelibs-3.3.1-2.12.FC3.src.rpm

be28a562a1d99f4530ac1866ab332199 x86_64/kdelibs-3.3.1-2.12.FC3.x86_64.rpm

784b411818c9a1a3d28811e814b9880a

x86_64/kdelibs-devel-3.3.1-2.12.FC3.x86_64.rpm

c81fb52aa13551ffb233f9ecc9ea72df

x86_64/debug/kdelibs-debuginfo-3.3.1-2.12.FC3.x86_64.rpm

0e6fdd04807160ee7571bcfb098d4c79 x86_64/kdelibs-3.3.1-2.12.FC3.i386.rpm

0e6fdd04807160ee7571bcfb098d4c79 i386/kdelibs-3.3.1-2.12.FC3.i386.rpm

f14c330fcc3f2c9618dc88550d4dd307 i386/kdelibs-devel-3.3.1-2.12.FC3.i386.rpm

bf6808e504ace10edb9da8b6f71efc5f

i386/debug/kdelibs-debuginfo-3.3.1-2.12.FC3.i386.rpm

This update can also be installed with the Update Agent; you can

launch the Update Agent with the 'up2date' command.

fedora-announce-list@redhat.com

http://www.redhat.com/mailman/listinfo/fedora-announce-list

FEDORA-2005-350 2005-05-02 Name : kdelibs Version : 3.3.1 Release : 2.12.FC3 Summary : K Desktop Environment - Libraries Description : Libraries for the K Desktop Environment: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). A buffer overflow was found in the kimgio library for KDE 3.3.1. An attacker could create a carefully crafted PCX image in such a way that it would cause kimgio to execute arbitrary code when processing the image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1046 to this issue. All users of kdelibs should upgrade to these updated packages, which contain a backported security patch to correct these issues. - apply patch to fix gcc warning #117938 * Tue Apr 19 2005 Than Ngo 6:3.3.1-2.11.FC3 - add missing kde documents #152307 - apply patch to fix kimgio input validation vulnerabilities, CAN-2005-1046 - add hack for loading of *.so shared object files #142244 * Mon Apr 18 2005 Than Ngo 6:3.3.1-2.10.FC3 - backport the patch to fix kimgio input validation vulnerabilities, CAN-2005-1046, #152093, thanks to KDE security team 1023f08e9573cd579ed4d978b8f7a7fb SRPMS/kdelibs-3.3.1-2.12.FC3.src.rpm be28a562a1d99f4530ac1866ab332199 x86_64/kdelibs-3.3.1-2.12.FC3.x86_64.rpm 784b411818c9a1a3d28811e814b9880a x86_64/kdelibs-devel-3.3.1-2.12.FC3.x86_64.rpm c81fb52aa13551ffb233f9ecc9ea72df x86_64/debug/kdelibs-debuginfo-3.3.1-2.12.FC3.x86_64.rpm 0e6fdd04807160ee7571bcfb098d4c79 x86_64/kdelibs-3.3.1-2.12.FC3.i386.rpm 0e6fdd04807160ee7571bcfb098d4c79 i386/kdelibs-3.3.1-2.12.FC3.i386.rpm f14c330fcc3f2c9618dc88550d4dd307 i386/kdelibs-devel-3.3.1-2.12.FC3.i386.rpm bf6808e504ace10edb9da8b6f71efc5f i386/debug/kdelibs-debuginfo-3.3.1-2.12.FC3.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. fedora-announce-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-announce-list

Change Log

References

Update Instructions

Severity
Name : kdelibs
Version : 3.3.1
Release : 2.12.FC3
Summary : K Desktop Environment - Libraries

Related News

4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved