KDE 3.4 Info Page
KDE 3.4 was released on March 16th, 2005. Read the official announcement.
Please report possible problems to email@example.com.
Patches for the issues mentioned below are available from ftp://ftp.kde.org/pub/kde/security_patches unless stated otherwise.
- The kdewebdev tool Kommander is vulnerable to unconfirmed execution
of code from untrusted locations.
Read the detailed advisory. All versions of KDE between KDE 3.2 and KDE 3.4.0 are affected.
- KImgio, the KDE image loader plugins, are vulnerable to several input
validation errors, possibly allowing to execute arbitrary code.
Read the detailed advisory. All versions of KDE up to and including KDE 3.4.0 are affected.
- The Kate KPart (used by the applications kate and kwrite, possibly others)
generates a backup file with default permissions upon saving. Depending
on the setup, this could cause file content leak to local and remote
(due to network transparency) users.
Read the detailed advisory. KDE 3.2.x up to including KDE 3.4.0 are affected.
- The Gadu-Gadu protocol handler of Kopete 3.3 and above contains a copy
of libgadu, that is used if there is no system installed libgadu library.
Multiple integer overflow vulnerabilities have been found in libgadu.
Read the detailed advisory. KDE 3.3.x up to including KDE 3.4.1 are affected.
- Kpdf shares code with xpdf, which contains a vulnerability that can cause it to write a temp file with almost infinite size to $TMPDIR upon parsing malformed PDF documents. detailed advisory. All KDE versions from 3.3.1 up to and including KDE 3.4.1 are affected.
- The langen2kvtml script (included in kdeedu/kvoctrain) contains
multiple temp file generation vulnerabilities.
Read the detailed advisory. KDE 3.0.x up to including KDE 3.4.2 are affected.
- The kcheckpass utility contains on certain platforms a local
Read the detailed advisory. KDE 3.2.0 up to including KDE 3.4.2 are affected.
- kpdf contains several buffer overflows in its xpdf-based code which can be triggered
by a specially crafted pdf file.
Read the detailed advisory. All versions of KDE up to and including KDE 3.5.0 are affected.
- kjs contains a heap based buffer overflow when decoding certain malcrafted utf8
Read the detailed advisory. All versions of KDE starting with KDE 3.2.0 up to and including KDE 3.5.0 are affected.
- kpdf contains a buffer overflow in its xpdf-based code which can be triggered
by a specially crafted pdf file.
Read the detailed advisory. All versions of KDE 3.3.0 up to and including KDE 3.5.1 are affected.
- KDM contains a symlink attack vulnerability that allows a normal
user to read files from other users including root.
Read the detailed advisory. All versions of KDE starting with KDE 3.2.0 up to and including KDE 3.5.2 are affected.
- kpdf contains a denial of service vulnerability in xpdf based code that
can cause the client to crash via a specially crafted pdf file.
Read the detailed advisory. All versions of KDE up to and including KDE 3.5.5 are affected.
This is a list of grave bugs and common pitfalls surfacing after the release date:
- A severe bug was found in the groupware support of kontact/kmail, which was too late for the KDE 3.4 release. Get kdepim-fix-imap-resource-type.diff (md5 sum: 1ec4778f0dbac85bc27bc2c2541e5c64) applied to the sources before you're using the groupware wizard.
Please check the bug database before filing any bug reports. Also check for possible updates on this page that might describe or fix your problem.
Download and Installation
Library Requirements. KDE 3.4 requires or benefits from the given list of libraries, most of which should be already installed on your system or available from your OS CD or your vendor's website.
The complete source code for KDE 3.4 is available for download:
The Konstruct build toolset can help you downloading and installing these tarballs.
Some Linux/UNIX OS vendors have kindly provided binary packages of KDE 3.4 for some versions of their distribution, and in other cases community volunteers have done so. Some of these binary packages are available for free download from KDE's http or FTP mirrors.
At the time of this release, pre-compiled packages are available for:
Additional binary packages might become available in the coming weeks, as well as updates to the current packages.