Bruno Rohee discovered a buffer overflow in the PCX decoder of kimgio.
If an attacker tricked a user into loading a malicious PCX image with a KDE application, he could exploit this to execute arbitrary code with the privileges of the user opening the image.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:393 advisory.

    KDE is a graphical desktop environment for the X Window System. Konqueror     is the file manager for the K Desktop Environment.

    A source code audit performed by the KDE security team discovered several     vulnerabilities in the PCX and other image file format readers.

    A buffer overflow was found in the kimgio library for KDE 3.4.0.  An     attacker could create a carefully crafted PCX image in such a way that it     would cause kimgio to execute arbitrary code when processing the image.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-1046 to this issue.

    All users of kdelibs should upgrade to these updated packages, which     contain a backported security patch to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200504-22 (KDE kimgio: PCX handling buffer overflow)

    kimgio fails to properly validate input when handling PCX files.
  Impact :

    By enticing a user to load a specially crafted PCX image in a KDE     application, an attacker could execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

KDE 3.3.1 用の kimgio ライブラリにバッファオーバーフローが見つかりました。攻撃者が注意深く細工された PCX 画像を作成して、その画像の処理時に kimgio に任意のコードを実行させる可能性があります。Common Vulnerabilities and Exposures プロジェクト（cve.mitre.org）は、この問題に CVE-2005-1046 の識別名を割り当てています。

kdelibs の全ユーザーは、バックポートされたセキュリティパッチが含まれるこれらの更新済みパッケージにアップグレードし、これらの問題を修正する必要があります。

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

在 KDE 3.3.1 的 kimgio 程式庫中發現一個緩衝區溢位。攻擊者可建立特製的 PCX 影像，其建立方式會導致在處理影像時，使 kimgio 執行任意程式碼。Common Vulnerabilities and Exposures 專案 (cve.mitre.org) 已將名稱 CVE-2005-1046 指派給此問題。

所有 kdelibs 使用者皆應升級至這些更新版套件，其中包含可更正這些問題的反向移植安全性修補程式。

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 KDE 3.3.1 的 kimgio 库中发现一个缓冲区溢出。攻击者可创建精心构建的 PCX 图像，使得在处理该图像时 kimgio 可执行任意代码。通用漏洞和暴露计划 (cve.mitre.org) 已为此问题分配名称 CVE-2005-1046。

所有 kdelibs 用户应升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的安全修补程序。

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

KDE security team discovered several vulnerabilities in the PCX and other image file format readers in the KDE core libraries, some of them exploitable to execute arbitrary code. To a small extent the packages in woody are affected as well.

Updated kdelibs packages that fix a flaw in kimgio input validation are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

KDE is a graphical desktop environment for the X Window System.
Konqueror is the file manager for the K Desktop Environment.

A source code audit performed by the KDE security team discovered several vulnerabilities in the PCX and other image file format readers.

A buffer overflow was found in the kimgio library for KDE 3.4.0. An attacker could create a carefully crafted PCX image in such a way that it would cause kimgio to execute arbitrary code when processing the image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1046 to this issue.

All users of kdelibs should upgrade to these updated packages, which contain a backported security patch to correct these issues.

A KDE Security Advisory reports :

kimgio contains a PCX image file format reader that does not properly perform input validation. A source code audit performed by the KDE security team discovered several vulnerabilities in the PCX and other image file format readers, some of them exploitable to execute arbitrary code.

Impact: Remotely supplied, specially crafted image files can be used to execute arbitrary code.

A buffer overflow was found in the kimgio library for KDE 3.3.1. An attacker could create a carefully crafted PCX image in such a way that it would cause kimgio to execute arbitrary code when processing the image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1046 to this issue.

All users of kdelibs should upgrade to these updated packages, which contain a backported security patch to correct these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in the PCX decoder of kimgio was discovered by Bruno Rohee. If an attacker could trick a user into loading a malicious PCX image with any KDE application, he could cause the execution of arbitrary code with the privileges of the user opening the image.

The provided packages have been patched to correct this issue.

In addition, the LE2005 packages contain fixes to configuring email into kbugreport, fixing a KDE crasher bug, fixing a kicondialog bug, a KHTML bug, and a knewsticker export symbol problem.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
20501	Ubuntu 5.04 : kdelibs vulnerability (USN-114-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	high
18279	RHEL 4 : kdelibs (RHSA-2005:393)	Nessus	Red Hat Local Security Checks	2005/5/17	2024/11/4	critical
18125	GLSA-200504-22 : KDE kimgio: PCX handling buffer overflow	Nessus	Gentoo Local Security Checks	2005/4/25	2021/1/6	high
62258	Fedora Core 3：kdelibs-3.3.1-2.12.FC3（2005-350）	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
62258	Fedora Core 3 : kdelibs-3.3.1-2.12.FC3 (2005-350)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
62258	Fedora Core 3：kdelibs-3.3.1-2.12.FC3 (2005-350)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
18143	Debian DSA-714-1 : kdelibs - several vulnerabilities	Nessus	Debian Local Security Checks	2005/4/27	2021/1/4	high
21933	CentOS 4 : kdelibs (CESA-2005:393)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	high
18828	FreeBSD : kdelibs -- kimgio input validation errors (06404241-b306-11d9-a788-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	high
62258	Fedora Core 3 : kdelibs-3.3.1-2.12.FC3 (2005-350)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
18274	Mandrake Linux Security Advisory : kdelibs (MDKSA-2005:085)	Nessus	Mandriva Local Security Checks	2005/5/17	2021/1/6	high

检测

插件搜索

high

critical

high

high

high

high

high

high

high

high

high