Synopsis

Important: kdegraphics security update

Type/Severity

Security Advisory: Important

Topic

Updated kdegraphics packages that fix several security issues are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The kdegraphics packages contain applications for the K Desktop
Environment. This includes kpdf, a PDF file viewer.

Alin Rad Pop discovered several flaws in the handling of PDF files. An
attacker could create a malicious PDF file that would cause kpdf to crash,
or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

All kdegraphics users are advised to upgrade to these updated packages,
which contain backported patches to resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc

Fixes

• BZ - 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit()
• BZ - 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset()
• BZ - 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar()

CVEs

• CVE-2007-5393
• CVE-2007-5392
• CVE-2007-4352

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 4

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
x86_64
kdegraphics-3.3.1-6.el4_5.x86_64.rpm	SHA-256: e414ed37a9263c21869f74cdaeec5752cef3d51444b4159e7397c04c745a3db1
kdegraphics-3.3.1-6.el4_5.x86_64.rpm	SHA-256: e414ed37a9263c21869f74cdaeec5752cef3d51444b4159e7397c04c745a3db1
kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm	SHA-256: 2f0497adee2f284c2ee4bb39df46e40151ed43b5befe5661e799fb14a07cce03
kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm	SHA-256: 2f0497adee2f284c2ee4bb39df46e40151ed43b5befe5661e799fb14a07cce03
ia64
kdegraphics-3.3.1-6.el4_5.ia64.rpm	SHA-256: 75cb9aefd53f64e5d91c9b6b6a1a3822573f349ae9ab04308212961a357c0905
kdegraphics-3.3.1-6.el4_5.ia64.rpm	SHA-256: 75cb9aefd53f64e5d91c9b6b6a1a3822573f349ae9ab04308212961a357c0905
kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm	SHA-256: 742640b86cbacd0948ca82de76fb128ae1ed95b5eb9b9f4a581910d620f9b863
kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm	SHA-256: 742640b86cbacd0948ca82de76fb128ae1ed95b5eb9b9f4a581910d620f9b863
i386
kdegraphics-3.3.1-6.el4_5.i386.rpm	SHA-256: 6ac1e1339b055956c1d2aae80c0885bad0a772895c755a88ed681f7a9c37793b
kdegraphics-3.3.1-6.el4_5.i386.rpm	SHA-256: 6ac1e1339b055956c1d2aae80c0885bad0a772895c755a88ed681f7a9c37793b
kdegraphics-devel-3.3.1-6.el4_5.i386.rpm	SHA-256: 6968dbbbb8bee4cfa142bb38912f4557dc1c1050eb893a368966e8dfe0e19d6d
kdegraphics-devel-3.3.1-6.el4_5.i386.rpm	SHA-256: 6968dbbbb8bee4cfa142bb38912f4557dc1c1050eb893a368966e8dfe0e19d6d

Red Hat Enterprise Linux Server - Extended Update Support 4.5

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
x86_64
kdegraphics-3.3.1-6.el4_5.x86_64.rpm	SHA-256: e414ed37a9263c21869f74cdaeec5752cef3d51444b4159e7397c04c745a3db1
kdegraphics-3.3.1-6.el4_5.x86_64.rpm	SHA-256: e414ed37a9263c21869f74cdaeec5752cef3d51444b4159e7397c04c745a3db1
kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm	SHA-256: 2f0497adee2f284c2ee4bb39df46e40151ed43b5befe5661e799fb14a07cce03
kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm	SHA-256: 2f0497adee2f284c2ee4bb39df46e40151ed43b5befe5661e799fb14a07cce03
ia64
kdegraphics-3.3.1-6.el4_5.ia64.rpm	SHA-256: 75cb9aefd53f64e5d91c9b6b6a1a3822573f349ae9ab04308212961a357c0905
kdegraphics-3.3.1-6.el4_5.ia64.rpm	SHA-256: 75cb9aefd53f64e5d91c9b6b6a1a3822573f349ae9ab04308212961a357c0905
kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm	SHA-256: 742640b86cbacd0948ca82de76fb128ae1ed95b5eb9b9f4a581910d620f9b863
kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm	SHA-256: 742640b86cbacd0948ca82de76fb128ae1ed95b5eb9b9f4a581910d620f9b863
i386
kdegraphics-3.3.1-6.el4_5.i386.rpm	SHA-256: 6ac1e1339b055956c1d2aae80c0885bad0a772895c755a88ed681f7a9c37793b
kdegraphics-3.3.1-6.el4_5.i386.rpm	SHA-256: 6ac1e1339b055956c1d2aae80c0885bad0a772895c755a88ed681f7a9c37793b
kdegraphics-devel-3.3.1-6.el4_5.i386.rpm	SHA-256: 6968dbbbb8bee4cfa142bb38912f4557dc1c1050eb893a368966e8dfe0e19d6d
kdegraphics-devel-3.3.1-6.el4_5.i386.rpm	SHA-256: 6968dbbbb8bee4cfa142bb38912f4557dc1c1050eb893a368966e8dfe0e19d6d

Red Hat Enterprise Linux Workstation 4

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
x86_64
kdegraphics-3.3.1-6.el4_5.x86_64.rpm	SHA-256: e414ed37a9263c21869f74cdaeec5752cef3d51444b4159e7397c04c745a3db1
kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm	SHA-256: 2f0497adee2f284c2ee4bb39df46e40151ed43b5befe5661e799fb14a07cce03
ia64
kdegraphics-3.3.1-6.el4_5.ia64.rpm	SHA-256: 75cb9aefd53f64e5d91c9b6b6a1a3822573f349ae9ab04308212961a357c0905
kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm	SHA-256: 742640b86cbacd0948ca82de76fb128ae1ed95b5eb9b9f4a581910d620f9b863
i386
kdegraphics-3.3.1-6.el4_5.i386.rpm	SHA-256: 6ac1e1339b055956c1d2aae80c0885bad0a772895c755a88ed681f7a9c37793b
kdegraphics-devel-3.3.1-6.el4_5.i386.rpm	SHA-256: 6968dbbbb8bee4cfa142bb38912f4557dc1c1050eb893a368966e8dfe0e19d6d

Red Hat Enterprise Linux Desktop 4

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
x86_64
kdegraphics-3.3.1-6.el4_5.x86_64.rpm	SHA-256: e414ed37a9263c21869f74cdaeec5752cef3d51444b4159e7397c04c745a3db1
kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm	SHA-256: 2f0497adee2f284c2ee4bb39df46e40151ed43b5befe5661e799fb14a07cce03
i386
kdegraphics-3.3.1-6.el4_5.i386.rpm	SHA-256: 6ac1e1339b055956c1d2aae80c0885bad0a772895c755a88ed681f7a9c37793b
kdegraphics-devel-3.3.1-6.el4_5.i386.rpm	SHA-256: 6968dbbbb8bee4cfa142bb38912f4557dc1c1050eb893a368966e8dfe0e19d6d

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
s390x
kdegraphics-3.3.1-6.el4_5.s390x.rpm	SHA-256: de7291ab0dae387e404903f7cf5503a6784b49c674ddf795860e5b9d3753057a
kdegraphics-devel-3.3.1-6.el4_5.s390x.rpm	SHA-256: e3652b3179077f1a4db436d9bca9b60c4ac6aee10707e7c63410ef9ada05e4b8
s390
kdegraphics-3.3.1-6.el4_5.s390.rpm	SHA-256: 3aac53610b194a88f71795365516ee44391dba37210d66cc57c94e709236c442
kdegraphics-devel-3.3.1-6.el4_5.s390.rpm	SHA-256: 0ab998220509300bd609e8d9c88238bf3a4411cf220fb104b7aafa077ebf67f7

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
s390x
kdegraphics-3.3.1-6.el4_5.s390x.rpm	SHA-256: de7291ab0dae387e404903f7cf5503a6784b49c674ddf795860e5b9d3753057a
kdegraphics-devel-3.3.1-6.el4_5.s390x.rpm	SHA-256: e3652b3179077f1a4db436d9bca9b60c4ac6aee10707e7c63410ef9ada05e4b8
s390
kdegraphics-3.3.1-6.el4_5.s390.rpm	SHA-256: 3aac53610b194a88f71795365516ee44391dba37210d66cc57c94e709236c442
kdegraphics-devel-3.3.1-6.el4_5.s390.rpm	SHA-256: 0ab998220509300bd609e8d9c88238bf3a4411cf220fb104b7aafa077ebf67f7

Red Hat Enterprise Linux for Power, big endian 4

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
ppc
kdegraphics-3.3.1-6.el4_5.ppc.rpm	SHA-256: ce75365d3adc99a5d82410cc05b7db311ed735015bc34fcd6d52df6976df36bf
kdegraphics-devel-3.3.1-6.el4_5.ppc.rpm	SHA-256: 6c69c4d1e26b24acdb67ed273af80aad8529e6af948f7b267ecf4245fd7b908e

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5

SRPM
kdegraphics-3.3.1-6.el4_5.src.rpm	SHA-256: 218e231b905c6983382dc68d2926ae11488d48bfd85f1baecaa8f9c73a662548
ppc
kdegraphics-3.3.1-6.el4_5.ppc.rpm	SHA-256: ce75365d3adc99a5d82410cc05b7db311ed735015bc34fcd6d52df6976df36bf
kdegraphics-devel-3.3.1-6.el4_5.ppc.rpm	SHA-256: 6c69c4d1e26b24acdb67ed273af80aad8529e6af948f7b267ecf4245fd7b908e