Bug#342294: koffice: Exploitable heap overflows in embedded xpdf copy

[Moritz Muehlenhoff <jmm@inutil.org>]

Package: koffice
Severity: grave
Tags: security
Justification: user security hole

Some heap overflows have been found in xpdf, of which koffice ships
a local copy. It is therefore vulnerable to a subset of the xpdf issues:

CVE-2005-3191:
http://www.idefense.com/application/poi/display?id=342
http://www.idefense.com/application/poi/display?id=343

CVE-2005-3192:
http://www.idefense.com/application/poi/display?id=344

pdftohtml is not vulnerable to CVE-2005-3193.

Cheers,
        Moritz

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-2-686
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15@euro (charmap=ISO-8859-15)