Joined: 25 Feb 2003
Location: Essen, Germany
|Posted: Sun Dec 19, 2004 8:03 pm Post subject: [ GLSA 200412-17 ] kfax: Multiple overflows in the included
|Gentoo Linux Security Advisory
Title: kfax: Multiple overflows in the included TIFF library (GLSA 200412-17)
Date: December 19, 2004
Updated: January 12, 2005
kfax contains several buffer overflows potentially leading to execution of arbitrary code.
KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. kfax (part of kdegraphics) is the KDE fax file viewer.
Vulnerable: < 3.3.2
Unaffected: >= 3.3.2
Architectures: All supported architectures
Than Ngo discovered that kfax contains a private copy of the TIFF library and is therefore subject to several known vulnerabilities (see References).
A remote attacker could entice a user to view a carefully-crafted TIFF image file with kfax, which would potentially lead to execution of arbitrary code with the rights of the user running kfax.
The KDE Team recommends to remove the kfax binary as well as the kfaxpart.la KPart:
Note: This will render the kfax functionality useless, if kfax functionality is needed you should upgrade to the KDE 3.3.2 which is not stable at the time of this writing. There is no known workaround at this time.
| rm /usr/kde/3.*/lib/kde3/kfaxpart.la rm /usr/kde/3.*/bin/kfax |
All kfax users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2"
KDE Security Advisory: kfax libtiff vulnerabilities
Last edited by GLSA on Sun May 07, 2006 4:54 pm; edited 1 time in total