Debian DSA-182-1 : kdegraphics - buffer overflow

medium Nessus Plugin ID 15019

Synopsis

The remote Debian host is missing a security-related update.

Description

Zen-parse discovered a buffer overflow in gv, a PostScript and PDF viewer for X11. The same code is present in kghostview which is part of the KDE-Graphics package. This problem is triggered by scanning the PostScript file and can be exploited by an attacker sending a malformed PostScript or PDF file. The attacker is able to cause arbitrary code to be run with the privileges of the victim.

Solution

Upgrade the kghostview package.

This problem has been fixed in version 2.2.2-6.8 for the current stable distribution (woody) and in version 2.2.2-6.9 for the unstable distribution (sid). The old stable distribution (potato) is not affected since no KDE is included.

See Also

http://www.debian.org/security/2002/dsa-182

Plugin Details

Severity: Medium

ID: 15019

File Name: debian_DSA-182.nasl

Version: 1.21

Type: local

Agent: unix

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:kdegraphics, cpe:/o:debian:debian_linux:3.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/28/2002

Vulnerability Publication Date: 12/4/2002

Reference Information

CVE: CVE-2002-0838

BID: 5808

DSA: 182