KDE Security Advisory: KOffice/KWord RTF import buffer overflow
Posted on: 10/11/2005 08:42 AM
KDE Security Advisory: KWord RTF import buffer overflow
Original Release Date: 2005-10-11
1. Systems affected:
All KOffice releases starting from KOffice 1.2.0 up to including KOffice 1.4.1.
Chris Evans reported a heap based buffer overflow in the RTF importer of KWord.
Opening specially crafted RTF files in KWord can cause execution of abitrary code.
Source code patches have been made available which fix these vulnerabilities. Contact your OS vendor / binary package provider for information about how to obtain updated binary packages.
Patch for KOffice 1.4.1 is available from ftp://ftp.kde.org/pub/kde/security_patches
Patch for KOffice 1.3.5 is available from ftp://ftp.kde.org/pub/kde/security_patches
Patch for KOffice 1.2.1 is available from ftp://ftp.kde.org/pub/kde/security_patches