Synopsis

kdelibs security update

Type/Severity

Security Advisory: Important

Topic

Updated kdelibs packages that fix a flaw in kimgio input validation are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

KDE is a graphical desktop environment for the X Window System. Konqueror
is the file manager for the K Desktop Environment.

A source code audit performed by the KDE security team discovered several
vulnerabilities in the PCX and other image file format readers.

A buffer overflow was found in the kimgio library for KDE 3.4.0. An
attacker could create a carefully crafted PCX image in such a way that it
would cause kimgio to execute arbitrary code when processing the image.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1046 to this issue.

All users of kdelibs should upgrade to these updated packages, which
contain a backported security patch to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 152092 - CAN-2005-1046 PCX file integer overflow

CVEs

• CVE-2005-1046

References

• http://bugs.kde.org/102328

Red Hat Enterprise Linux Server 4

SRPM
kdelibs-3.3.1-3.10.src.rpm	SHA-256: 770e48a92ab377073886127985e2cb8f4f89f4cda12e6e02706ae939e56d9f48
x86_64
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.x86_64.rpm	SHA-256: 7d87277921c40d4324162249ebc05c2928b5a66e2e3cbce15ba90db401eaa62f
kdelibs-3.3.1-3.10.x86_64.rpm	SHA-256: 7d87277921c40d4324162249ebc05c2928b5a66e2e3cbce15ba90db401eaa62f
kdelibs-devel-3.3.1-3.10.x86_64.rpm	SHA-256: 58171db99d5ebaa4b2c645dce2c28aac703fe8ea37332431a8c27d371ce241bc
kdelibs-devel-3.3.1-3.10.x86_64.rpm	SHA-256: 58171db99d5ebaa4b2c645dce2c28aac703fe8ea37332431a8c27d371ce241bc
ia64
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.ia64.rpm	SHA-256: b90aea977a2ba7e45762debe015ff96832259feacd9bfcdbd422beca6e3369e1
kdelibs-3.3.1-3.10.ia64.rpm	SHA-256: b90aea977a2ba7e45762debe015ff96832259feacd9bfcdbd422beca6e3369e1
kdelibs-devel-3.3.1-3.10.ia64.rpm	SHA-256: d524b5722889a3d1830fc246da381ac4238fa3a833489783c728ad1f42a40115
kdelibs-devel-3.3.1-3.10.ia64.rpm	SHA-256: d524b5722889a3d1830fc246da381ac4238fa3a833489783c728ad1f42a40115
i386
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-devel-3.3.1-3.10.i386.rpm	SHA-256: 3709d0161e0c21bfca6d0979b68d0205fc9992fd943df7ece580a742da40c66c
kdelibs-devel-3.3.1-3.10.i386.rpm	SHA-256: 3709d0161e0c21bfca6d0979b68d0205fc9992fd943df7ece580a742da40c66c

Red Hat Enterprise Linux Workstation 4

SRPM
kdelibs-3.3.1-3.10.src.rpm	SHA-256: 770e48a92ab377073886127985e2cb8f4f89f4cda12e6e02706ae939e56d9f48
x86_64
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.x86_64.rpm	SHA-256: 7d87277921c40d4324162249ebc05c2928b5a66e2e3cbce15ba90db401eaa62f
kdelibs-devel-3.3.1-3.10.x86_64.rpm	SHA-256: 58171db99d5ebaa4b2c645dce2c28aac703fe8ea37332431a8c27d371ce241bc
ia64
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.ia64.rpm	SHA-256: b90aea977a2ba7e45762debe015ff96832259feacd9bfcdbd422beca6e3369e1
kdelibs-devel-3.3.1-3.10.ia64.rpm	SHA-256: d524b5722889a3d1830fc246da381ac4238fa3a833489783c728ad1f42a40115
i386
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-devel-3.3.1-3.10.i386.rpm	SHA-256: 3709d0161e0c21bfca6d0979b68d0205fc9992fd943df7ece580a742da40c66c

Red Hat Enterprise Linux Desktop 4

SRPM
kdelibs-3.3.1-3.10.src.rpm	SHA-256: 770e48a92ab377073886127985e2cb8f4f89f4cda12e6e02706ae939e56d9f48
x86_64
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-3.3.1-3.10.x86_64.rpm	SHA-256: 7d87277921c40d4324162249ebc05c2928b5a66e2e3cbce15ba90db401eaa62f
kdelibs-devel-3.3.1-3.10.x86_64.rpm	SHA-256: 58171db99d5ebaa4b2c645dce2c28aac703fe8ea37332431a8c27d371ce241bc
i386
kdelibs-3.3.1-3.10.i386.rpm	SHA-256: 1fcd6eec8dab67c7ce0df955632358de6dc8bf90705f0ec02bdff4404f898281
kdelibs-devel-3.3.1-3.10.i386.rpm	SHA-256: 3709d0161e0c21bfca6d0979b68d0205fc9992fd943df7ece580a742da40c66c

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
kdelibs-3.3.1-3.10.src.rpm	SHA-256: 770e48a92ab377073886127985e2cb8f4f89f4cda12e6e02706ae939e56d9f48
s390x
kdelibs-3.3.1-3.10.s390.rpm	SHA-256: 0c781f6d7a222664d8c993f0fba0806e09ff58b1980fd1ccef740035fd836999
kdelibs-3.3.1-3.10.s390x.rpm	SHA-256: da3515f91b31cd24c376dbf88ee572ab2d5415f878552d946c9250ca83b1fd68
kdelibs-devel-3.3.1-3.10.s390x.rpm	SHA-256: 3c2efd218e3fc03283e3b6a109a57eaf1318cf044d2005bf8456eabd1c1be434
s390
kdelibs-3.3.1-3.10.s390.rpm	SHA-256: 0c781f6d7a222664d8c993f0fba0806e09ff58b1980fd1ccef740035fd836999
kdelibs-devel-3.3.1-3.10.s390.rpm	SHA-256: 84e254f0a59b1e36691cd9e11af34e6a3f7266af5e855fc6c2d70dddfd64ed7f

Red Hat Enterprise Linux for Power, big endian 4

SRPM
kdelibs-3.3.1-3.10.src.rpm	SHA-256: 770e48a92ab377073886127985e2cb8f4f89f4cda12e6e02706ae939e56d9f48
ppc
kdelibs-3.3.1-3.10.ppc.rpm	SHA-256: 1f1a44e691230668185481cd64615c0d40256d44fffa12ac10a24cbb87c3743d
kdelibs-3.3.1-3.10.ppc64.rpm	SHA-256: 2906b5fad61b4b480d340d0789f83755b27e5daec008dc26da5d8608c07a9bc0
kdelibs-devel-3.3.1-3.10.ppc.rpm	SHA-256: 27ba39e8feaf15ba4acea2c8ece7227cf5879f81e517345caa0b0f402ba8d547