-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: kdegraphics security update
Advisory ID:       RHSA-2006:0648-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2006-0648.html
Issue date:        2006-08-28
Updated on:        2006-08-28
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-3459 CVE-2006-3460 CVE-2006-3461 
                   CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 
                   CVE-2006-3465 
- ---------------------------------------------------------------------

1. Summary:

Updated kdegraphics packages that fix several security flaws in kfax are
now available for Red Hat Enterprise Linux 2.1, and 3.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

The kdegraphics package contains graphics applications for the K Desktop
Environment.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a
security audit.  The kfax application contains a copy of the libtiff code
used for parsing TIFF files and is therefore affected by these flaws.  
An attacker who has the ability to trick a user into opening a malicious
TIFF file could cause kfax to crash or possibly execute arbitrary code.
(CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463,
CVE-2006-3464, CVE-2006-3465)

Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses
the shared libtiff library which has been fixed in a previous update.

Users of kfax should upgrade to these updated packages, which contain
backported patches and are not vulnerable to this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

201313 - CVE-2006-3459 kfax affected by libtiff flaws (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465)

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

i386:
95b171e3e34fb770f40ca342201b8530  kdegraphics-2.2.2-4.4.i386.rpm
92d41638599ce40f99bd4dae53d4557d  kdegraphics-devel-2.2.2-4.4.i386.rpm

ia64:
b60111c884c0c11fe38c014fd2aa20a4  kdegraphics-2.2.2-4.4.ia64.rpm
8d3017d74b4c39ca38c6840127134b7d  kdegraphics-devel-2.2.2-4.4.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

ia64:
b60111c884c0c11fe38c014fd2aa20a4  kdegraphics-2.2.2-4.4.ia64.rpm
8d3017d74b4c39ca38c6840127134b7d  kdegraphics-devel-2.2.2-4.4.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

i386:
95b171e3e34fb770f40ca342201b8530  kdegraphics-2.2.2-4.4.i386.rpm
92d41638599ce40f99bd4dae53d4557d  kdegraphics-devel-2.2.2-4.4.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm
7e02f00c6f0f04f4b2d344a4ec023d8f  kdegraphics-2.2.2-4.4.src.rpm

i386:
95b171e3e34fb770f40ca342201b8530  kdegraphics-2.2.2-4.4.i386.rpm
92d41638599ce40f99bd4dae53d4557d  kdegraphics-devel-2.2.2-4.4.i386.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

ia64:
26bd834fd42ee5aeeab12cb1e7255f4f  kdegraphics-3.1.3-3.10.ia64.rpm
c1de4ef881ce270b2927afd8153b5d8e  kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm
7186b1f5ca78824f67b73cf9b83351d7  kdegraphics-devel-3.1.3-3.10.ia64.rpm

ppc:
9f6cdd9650db6608f972c42c76e8a4de  kdegraphics-3.1.3-3.10.ppc.rpm
966ce65766809c0839f90bc7ee319f6d  kdegraphics-debuginfo-3.1.3-3.10.ppc.rpm
b452e2ef7748b702aa75b10dcc33f17c  kdegraphics-devel-3.1.3-3.10.ppc.rpm

s390:
866768918b02cd3601a304a59d15ad51  kdegraphics-3.1.3-3.10.s390.rpm
ce2c5282ee6694998f105b322107489c  kdegraphics-debuginfo-3.1.3-3.10.s390.rpm
a3055e2cf71f6e7620a9c84a6058be7f  kdegraphics-devel-3.1.3-3.10.s390.rpm

s390x:
522c7089c601e9ed8d01e478503a795a  kdegraphics-3.1.3-3.10.s390x.rpm
e6e1f1c463c44748d85e1a073a96c30e  kdegraphics-debuginfo-3.1.3-3.10.s390x.rpm
893a3ad832cfdc2e65ec585536717ca0  kdegraphics-devel-3.1.3-3.10.s390x.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

ia64:
26bd834fd42ee5aeeab12cb1e7255f4f  kdegraphics-3.1.3-3.10.ia64.rpm
c1de4ef881ce270b2927afd8153b5d8e  kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm
7186b1f5ca78824f67b73cf9b83351d7  kdegraphics-devel-3.1.3-3.10.ia64.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm
ef88572cbd568315228054297655ef86  kdegraphics-3.1.3-3.10.src.rpm

i386:
854050e9b33c97244bb7d7c9e5448257  kdegraphics-3.1.3-3.10.i386.rpm
5b947fa999294d0458c4f9e28204609d  kdegraphics-debuginfo-3.1.3-3.10.i386.rpm
5da00f57f88c1f99308ede725c43c73c  kdegraphics-devel-3.1.3-3.10.i386.rpm

ia64:
26bd834fd42ee5aeeab12cb1e7255f4f  kdegraphics-3.1.3-3.10.ia64.rpm
c1de4ef881ce270b2927afd8153b5d8e  kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm
7186b1f5ca78824f67b73cf9b83351d7  kdegraphics-devel-3.1.3-3.10.ia64.rpm

x86_64:
ce51d29598cdc0ac9aa433a669f37d7f  kdegraphics-3.1.3-3.10.x86_64.rpm
0e243626db71c4d70fe76055684af12f  kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm
f83a0c0a9cedf3728b6cc02f12cac6e6  kdegraphics-devel-3.1.3-3.10.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFE8uTyXlSAg2UNWIIRAqozAJ415P8NQEd17yEn6pvMCW+S2XQDUQCeNGsT
aJzT9G/eEPRFHU3SieZ4zFM=
=cEPk
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list