Debian DSA-1793-1 : kdegraphics - multiple vulnerabilities

NASLDB: Debian DSA-1793-1 : kdegraphics - multiple vulnerabilities

General

ID: 38703
Name: Debian DSA-1793-1 : kdegraphics – multiple vulnerabilities

Summary: Checks dpkg output for the updated package

Credits: –

Classification

Risk: –

CVSS: –
CVSS Base Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Temporal Vector: –

Port: 0
Family: Debian Local Security Checks
Type: Local

Description

kpdf, a Portable Document Format (PDF) viewer for KDE, is based on the
xpdf program and thus suffers from similar flaws to those described in
DSA-1790.

The Common Vulnerabilities and Exposures project identifies the
following problems :

– CVE-2009-0146
Multiple buffer overflows in the JBIG2 decoder in kpdf
allow remote attackers to cause a denial of service
(crash) via a crafted PDF file, related to (1)
JBIG2SymbolDict::setBitmap and (2)
JBIG2Stream::readSymbolDictSeg.

– CVE-2009-0147
Multiple integer overflows in the JBIG2 decoder in kpdf
allow remote attackers to cause a denial of service
(crash) via a crafted PDF file, related to (1)
JBIG2Stream::readSymbolDictSeg, (2)
JBIG2Stream::readSymbolDictSeg, and (3)
JBIG2Stream::readGenericBitmap.

– CVE-2009-0165
Integer overflow in the JBIG2 decoder in kpdf has
unspecified impact related to ‘g*allocn.’

– CVE-2009-0166
The JBIG2 decoder in kpdf allows remote attackers to
cause a denial of service (crash) via a crafted PDF file
that triggers a free of uninitialized memory.

– CVE-2009-0799
The JBIG2 decoder in kpdf allows remote attackers to
cause a denial of service (crash) via a crafted PDF file
that triggers an out-of-bounds read.

– CVE-2009-0800
Multiple ‘input validation flaws’ in the JBIG2 decoder
in kpdf allow remote attackers to execute arbitrary code
via a crafted PDF file.

– CVE-2009-1179
Integer overflow in the JBIG2 decoder in kpdf allows
remote attackers to execute arbitrary code via a crafted
PDF file.

– CVE-2009-1180
The JBIG2 decoder in kpdf allows remote attackers to
execute arbitrary code via a crafted PDF file that
triggers a free of invalid data.

– CVE-2009-1181
The JBIG2 decoder in kpdf allows remote attackers to
cause a denial of service (crash) via a crafted PDF file
that triggers a NULL pointer dereference.

– CVE-2009-1182
Multiple buffer overflows in the JBIG2 MMR decoder in
kpdf allow remote attackers to execute arbitrary code
via a crafted PDF file.

– CVE-2009-1183
The JBIG2 MMR decoder in kpdf allows remote attackers to
cause a denial of service (infinite loop and hang) via a
crafted PDF file.

The old stable distribution (etch), these problems have been fixed in
version 3.5.5-3etch3.

Exploiting

Exploit Available: –
Exploitability Ease: –

Sources

CVE: CVE-2009-0146
OSVDB: –
Bugtraq: –
scipID: –

Timeline

Vulnerability Disclosure: –
Patch Release: 2009/05/06
Plugin Release: 2009/05/08

Plugin

Version: 1.6
Filename: debian_DSA-1793.nasl
Filesize: 10893 bytes
MD5 Hash: 261da8acfa2b75ef4701d0bd9e35c995

Identification: Host/local_checks_enabled
Require Keys: Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l
Dependencies: "ssh_get_info.nasl"

Latest Plugins

Latest Plugins

scip AG