Date: Tue, 07 Mar 2006 17:23:58 -0500
From: Josh Bressers <bressers@redhat.com>
To: Marcelo Ricardo Leitner <mrl@conectiva.com.br>
Cc: vendor-sec@lst.de, mueller@kde.org
Subject: Re: [vendor-sec] kpdf official patch for kde 3.3 does not fix
    CVE-2005-3627

> 
> --zhXaljGHf11kAtnf
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> 
> Hi all,
> 
> I was working on some xpdf updates again overhere when I noticed that even
> when I patched kpdf with the official patch publicated at
> http://www.kde.org/info/security/advisory-20051207-2.txt it crashed with
> Chris' bad11.pdf testcase.
> 
> Then I applied the official patch and went by checking chunk by chunk
> against the xpdf's official, available at
> http://www.foolabs.com/xpdf/download.html (12097 bytes version) and noticed
> some missing chunks.
> 
> Here follows my diffs against the official patch just for reference and then
> the patch I'm currently using.

Nice catch Marcelo.

Let's use CVE-2006-0746 for this since the original CVE id (CVE-2005-3627)
covered a handful of overflows, one of which is missed in kdegraphics.

-- 
    JB