PT-2006-1089 · Kde · Kdegraphics

Marcus Meissner · Published 2006-12-05 · Updated 2011-08-04 · CVE-2006-6297

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: kdegraphics versions prior to 3.5.5

Description: The issue is related to a stack consumption vulnerability in the KFILE JPEG plugin, which can be exploited by remote attackers. This vulnerability can cause a denial of service due to stack consumption via a crafted EXIF section in a JPEG file, resulting in an infinite recursion. The vulnerability can be exploited remotely, potentially leading to disruption of protected information.

Recommendations: For kdegraphics versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue. As a temporary workaround, consider disabling the KFILE JPEG plugin until a patch is available. Restrict access to JPEG files with crafted EXIF sections to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-09546

CVE-2006-6297

Affected Products

Kdegraphics

References · 13

• http://mandriva.com/security/advisories?name=MDKSA-2006:227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6297 · Security Note
• http://secunia.com/advisories/23213 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_73_mono.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200701-05.xml · Vendor Advisory
• http://secunia.com/advisories/23300 · Vendor Advisory
• http://secunia.com/advisories/23728 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09546 · Security Note
• http://vupen.com/english/advisories/2006/4810 · Vendor Advisory
• http://secunia.com/advisories/23203 · Vendor Advisory
• http://securitytracker.com/id?1017325 · Note
• http://securityfocus.com/bid/21384 · Note
• http://kde.org/info/security/advisory-20061129-1.txt · Note