Synopsis: Critical: kdegraphics security update Issue date: 2009-06-25 CVE Names: CVE-2009-0945 CVE-2009-1709 A use-after-free flaw was found in the KDE KSVG animation element implementation. A remote attacker could create a specially-crafted SVG image, which once opened by an unsuspecting user, could cause a denial of service (Konqueror crash) or, potentially, execute arbitrary code with the privileges of the user running Konqueror. (CVE-2009-1709) A NULL pointer dereference flaw was found in the KDE, KSVG SVGList interface implementation. A remote attacker could create a specially-crafted SVG image, which once opened by an unsuspecting user, would cause memory corruption, leading to a denial of service (Konqueror crash). (CVE-2009-0945) The desktop must be restarted (log out, then log back in) for this update to take effect. SL 5.x SRPMS: kdegraphics-3.5.4-13.el5_3.src.rpm i386: kdegraphics-3.5.4-13.el5_3.i386.rpm kdegraphics-devel-3.5.4-13.el5_3.i386.rpm x86_64: kdegraphics-3.5.4-13.el5_3.x86_64.rpm kdegraphics-devel-3.5.4-13.el5_3.i386.rpm kdegraphics-devel-3.5.4-13.el5_3.x86_64.rpm -Connie Sieh -Troy Dawson