Synopsis:	Critical: kdegraphics security update
Issue date:	2009-06-25
CVE Names:	CVE-2009-0945 CVE-2009-1709

A use-after-free flaw was found in the KDE KSVG animation element
implementation. A remote attacker could create a specially-crafted SVG
image, which once opened by an unsuspecting user, could cause a denial 
of service (Konqueror crash) or, potentially, execute arbitrary code 
with the privileges of the user running Konqueror. (CVE-2009-1709)

A NULL pointer dereference flaw was found in the KDE, KSVG SVGList
interface implementation. A remote attacker could create a
specially-crafted SVG image, which once opened by an unsuspecting user,
would cause memory corruption, leading to a denial of service (Konqueror
crash). (CVE-2009-0945)

The desktop must be restarted (log out, then log back in) for this 
update to take effect.

SL 5.x

     SRPMS:
kdegraphics-3.5.4-13.el5_3.src.rpm
     i386:
kdegraphics-3.5.4-13.el5_3.i386.rpm
kdegraphics-devel-3.5.4-13.el5_3.i386.rpm
     x86_64:
kdegraphics-3.5.4-13.el5_3.x86_64.rpm
kdegraphics-devel-3.5.4-13.el5_3.i386.rpm
kdegraphics-devel-3.5.4-13.el5_3.x86_64.rpm

-Connie Sieh
-Troy Dawson