khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read.

The remote host is affected by the vulnerability described in GLSA-201406-31 (Konqueror: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Konqueror. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted web       site using Konqueror, possibly resulting in the execution of arbitrary       code with the privileges of the process or a Denial of Service condition   Workaround :

    There is no known workaround at this time.

This update of kdelibs fixed various memory corruption vulnerabilities.

On openSUSE 12.1 a akregator crash on closing tab was fixed.

This kdelibs4 update fixes several security issues related to khtml/konqueror.

  - Fix security issues and NULL pointer references in     khtml/konqueror (bnc#787520) (CVE-2012-4512 /     CVE-2012-4513 / CVE-2012-4515)

From Red Hat Security Advisory 2012:1418 :

Updated kdelibs packages that fix two security issues are now available for Red Hat Enterprise Linux 6 FasTrack.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kdelibs packages provide libraries for the K Desktop Environment (KDE). Konqueror is a web browser.

A heap-based buffer overflow flaw was found in the way the CSS (Cascading Style Sheets) parser in kdelibs parsed the location of the source for font faces. A web page containing malicious content could cause an application using kdelibs (such as Konqueror) to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4512)

A heap-based buffer over-read flaw was found in the way kdelibs calculated canvas dimensions for large images. A web page containing malicious content could cause an application using kdelibs to crash or disclose portions of its memory. (CVE-2012-4513)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.

From Red Hat Security Advisory 2012:1416 :

Updated kdelibs packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kdelibs packages provide libraries for the K Desktop Environment (KDE). Konqueror is a web browser.

A heap-based buffer overflow flaw was found in the way the CSS (Cascading Style Sheets) parser in kdelibs parsed the location of the source for font faces. A web page containing malicious content could cause an application using kdelibs (such as Konqueror) to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4512)

A heap-based buffer over-read flaw was found in the way kdelibs calculated canvas dimensions for large images. A web page containing malicious content could cause an application using kdelibs to crash or disclose portions of its memory. (CVE-2012-4513)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.

Updated kdelibs packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kdelibs packages provide libraries for the K Desktop Environment (KDE). Konqueror is a web browser.

A heap-based buffer overflow flaw was found in the way the CSS (Cascading Style Sheets) parser in kdelibs parsed the location of the source for font faces. A web page containing malicious content could cause an application using kdelibs (such as Konqueror) to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4512)

A heap-based buffer over-read flaw was found in the way kdelibs calculated canvas dimensions for large images. A web page containing malicious content could cause an application using kdelibs to crash or disclose portions of its memory. (CVE-2012-4513)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.

A heap-based buffer over-read flaw was found in the way kdelibs calculated canvas dimensions for large images. A web page containing malicious content could cause an application using kdelibs to crash or disclose portions of its memory. (CVE-2012-4513)

The desktop must be restarted (log out, then log back in) for this update to take effect.

Updated kdelibs packages that fix two security issues are now available for Red Hat Enterprise Linux 6 FasTrack.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kdelibs packages provide libraries for the K Desktop Environment (KDE). Konqueror is a web browser.

A heap-based buffer overflow flaw was found in the way the CSS (Cascading Style Sheets) parser in kdelibs parsed the location of the source for font faces. A web page containing malicious content could cause an application using kdelibs (such as Konqueror) to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-4512)

A heap-based buffer over-read flaw was found in the way kdelibs calculated canvas dimensions for large images. A web page containing malicious content could cause an application using kdelibs to crash or disclose portions of its memory. (CVE-2012-4513)

Users should upgrade to these updated packages, which contain backported patches to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect.

ID	Name	Product	Family	Severity
76288	GLSA-201406-31 : Konqueror: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
74823	openSUSE Security Update : kdelibs4 (openSUSE-SU-2012:1581-1)	Nessus	SuSE Local Security Checks	high
70632	SuSE 11.2 / 11.3 Security Update : kdelibs4 (SAT Patch Numbers 8401 / 8402)	Nessus	SuSE Local Security Checks	medium
68650	Oracle Linux 6 : kdelibs (ELSA-2012-1418)	Nessus	Oracle Linux Local Security Checks	high
68649	Oracle Linux 6 : kdelibs (ELSA-2012-1416)	Nessus	Oracle Linux Local Security Checks	high
67095	CentOS 6 : kdelibs (CESA-2012:1416)	Nessus	CentOS Local Security Checks	high
62775	Scientific Linux Security Update : kdelibs on SL6.x i386/x86_64 (20121030)	Nessus	Scientific Linux Local Security Checks	high
62772	RHEL 6 : kdelibs (RHSA-2012:1418)	Nessus	Red Hat Local Security Checks	medium
62771	RHEL 6 : kdelibs (RHSA-2012:1416)	Nessus	Red Hat Local Security Checks	high
62764	CentOS 6 : kdelibs (CESA-2012:1418)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2012-4513

high

Tenable Plugins

high

high

medium

high

high

high

high

medium

high

high