Bugzilla Bug 162460

KDE Security Advisory: kpdf/kword/xpdf denial of service vulnerability
Original Release Date: 2007-01-15
URL: http://www.kde.org/info/security/advisory-20070115-1.txt

0. References
        CVE-2007-0104


1. Systems affected:

        KDE 3.2.0 up to including KDE 3.5.5. KDE 3.5.6 and newer is
        not affected. KOffice 1.2 and newer contain the same code.


2. Overview:

        kpdf, the KDE pdf viewer, shares code with xpdf. xpdf contains
        a vulnerability that can cause denial of service (infinite loop)
        via a PDF file that contains a crafted catalog dictionary
        or a crafted Pages attribute that references an invalid page
        tree node.


3. Impact:

        Remotely supplied pdf files can be used to disrupt the kpdf
        viewer on the client machine.


4. Solution:

        Source code patches have been made available which fix these
        vulnerabilities. Contact your OS vendor / binary package provider
        for information about how to obtain updated binary packages.


5. Patch:

        Patch for KOffice 1.2.1 and newer is available from 
        ftp://ftp.kde.org/pub/kde/security_patches :

        dc28881c39f11c040f8c942e4af238d1  koffce-xpdf-CVE-2007-0104.diff

        Patch for KDE 3.3.2 and newer is available from 
        ftp://ftp.kde.org/pub/kde/security_patches :

        a690ce46117257609c2b43485ea4d0d7 
post-3.5.5-kdegraphics-CVE-2007-0104.diff

        Patch for KDE 3.2.3 and newer is available from 
        ftp://ftp.kde.org/pub/kde/security_patches :

        c2d4c2aa3aa990e2dba00f782a140a1b 
post-3.2.3-kdegraphics-CVE-2007-0104.diff



Note: our kpdf/kdegraphics is *not* vulnerable, as we use Kubuntu's Poppler
patch.

And it's fixed in kword-1.5.2-r1, kword-1.6.1-r1, koffice-1.5.2-r2 and
koffice-1.6.1-r1.

client DoS, i tend to say we dont care

Most advisories (Securityfocus[1], CVE[2], x-force[3], original advisory[4])
mention the possible execution of arbitrary code (buffer overflows, ...). And
xpdf seems affected too. Ccing printing.

[1] http://xforce.iss.net/xforce/xfdb/31364
[2] http://xforce.iss.net/xforce/xfdb/31364
[3] http://xforce.iss.net/xforce/xfdb/31364
[4] http://projects.info-pull.com/moab/MOAB-06-01-2007.html

ping printing

If you want, kdegraphics and kpdf can be handled by stabling the latest
releases for 3.5.5: they both are patched to fix this issue, as they don't use
poppler anymore.

kpdf in KDE before 3.5.5 is also affected

(In reply to comment #5)
> kpdf in KDE before 3.5.5 is also affected
> 


Our kpdf-3.5.5 uses the vulnerable poppler. 

Since we have no response from printing team about a poppler upgrade, we have
to fix our KDE ports.

Arches, please test and mark stable if appropriate, thanks.

kpdf-3.5.5-r1
kword-1.5.2-r1
koffice-1.5.2-r2

And kdegraphics-3.5.5-r2.

poppler patch committed, sorry for being late and feel free to patch such
things when I am irregularly looking at my mail.

(In reply to comment #8)
> poppler patch committed, sorry for being late and feel free to patch such
> things when I am irregularly looking at my mail.
> 

Good, thanks.


Arches, please also test and stabilize poppler-0.5.4-r1 . KDE stabilizations
are not a priority: if a KDE stabilization fails, the poppler stabilization
will be sufficient from the security point of view.

ARM, HPPA, MIPS and S390, you're only concerned by poppler, not by KDE.

A fixed xpdf is still missing but i bet it's only a question of time.

xpdf won't need to be changed since it calls poppler.

(In reply to comment #6)
> Arches, please test and mark stable if appropriate, thanks.
> koffice-1.5.2-r2

 We have bug 166246 which requests stabilisation for KOffice 1.6.* series.

poppler and kpdf stable on x86, adding koffice 1.6.1-r1 stabilisation bug as
dependency

(In reply to comment #11)
>
>  We have bug 166246 which requests stabilisation for KOffice 1.6.* series.
> 

Thanks,

I hope that fix the pdf vulnerability, in such case stabilizing koffice-1.6 is
sufficient for koffice

KOffice monolithic and meta stable, kdegraphics stable, so removing x86

app-text/poppler, app-office/koffice and kde-base/kdegraphics stable for HPPA.

sparc stable: poppler-0.5.4-r1, kpdf-3.5.5-r1, kdegraphics-3.5.5-r2,
kword-1.5.2-r1, koffice-1.5.2-r2.
Gotta check some issues with koffice-1.6.1 before it can go stable.

koffice-1.6.1 and friends are all stable on amd64, as are kpdf, kdegraphics and
poppler as specified in the previous comments. Removing amd64.

these are stable on ppc64 now:

app-text/poppler-0.5.4-r1
kde-base/kpdf-3.5.5-r1
kde-base/kdegraphics-3.5.5-r2
dev-lang/swig-1.3.31
media-libs/lcms-1.15
app-office/koffice-1.6.1-r1
app-office/koffice-data-1.6.1
app-office/koffice-libs-1.6.1
app-office/kexi-1.6.1
app-office/kchart-1.6.1
app-office/kplato-1.6.1
app-office/kivio-1.6.1
app-office/kformula-1.6.1
app-office/kugar-1.6.1
app-office/krita-1.6.1
app-office/kpresenter-1.6.1
app-office/karbon-1.6.1
app-office/kspread-1.6.1
app-office/kword-1.6.1-r1
app-office/koshell-1.6.1
app-office/koffice-meta-1.6.1

IA64 done.

ppc stable

Alpha done.

oops, late. GLSA or no?

CVE says "unknown impact" -> i tend to vote "no"

if execution of arbitrary code is confirmed, i tend to vote yes.

(In reply to comment #23)
> if execution of arbitrary code is confirmed, i tend to vote yes.
> 

AFAICT it's not

Security please comment

I tend to vote NO GLSA. At least the KDE advisory says infinite loop only.

closing then, feel free to reopen if you disagree