[ GLSA 200412-17 ] kfax: Multiple overflows in the included TIFF library

[GLSA]

Gentoo Linux Security Advisory

Title: kfax: Multiple overflows in the included TIFF library (GLSA 200412-17)
Severity: normal
Exploitable: remote
Date: December 19, 2004
Updated: January 12, 2005
Bug(s): #73795
ID: 200412-17

Synopsis


kfax contains several buffer overflows potentially leading to execution of
arbitrary code.


Background


KDE is a feature-rich graphical desktop environment for Linux and
Unix-like Operating Systems. kfax (part of kdegraphics) is the KDE fax
file viewer.


Affected Packages

Package: kde-base/kdegraphics
Vulnerable: < 3.3.2
Unaffected: >= 3.3.2
Architectures: All supported architectures


Description


Than Ngo discovered that kfax contains a private copy of the TIFF
library and is therefore subject to several known vulnerabilities (see
References).


Impact


A remote attacker could entice a user to view a carefully-crafted TIFF
image file with kfax, which would potentially lead to execution of
arbitrary code with the rights of the user running kfax.


Workaround


The KDE Team recommends to remove the kfax binary as well as the
kfaxpart.la KPart: