[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[USN-1110-1] KDE-Libs vulnerabilities

Ubuntu Security Notice USN-1110-1
April 14, 2011

kde4libs vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 9.10


An attacker could send crafted input to Konqueror to view sensitive

Software Description:
- kde4libs: KDE 4 core applications


It was discovered that KDE KSSL did not properly verify X.509 certificates
when the certificate was issued for an IP address. An attacker could
exploit this to perform a man in the middle attack to view sensitive
information or alter encrypted communications. (CVE-2011-1094)

Tim Brown discovered that KDE KHTML did not properly escape URLs from
externally generated error pages. An attacker could expoit this to conduct
cross-site scripting attacks. With cross-site scripting vulnerabilities, if
a user were tricked into viewing server output during a crafted server
request, a remote attacker could exploit this to modify the contents, or
steal confidential data (such as passwords), within the same domain.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
  libkhtml5                       4:4.5.1-0ubuntu8.1
  libkio5                         4:4.5.1-0ubuntu8.1

Ubuntu 10.04 LTS:
  kdelibs5                        4:4.4.5-0ubuntu1.1

Ubuntu 9.10:
  kdelibs5                        4:4.3.2-0ubuntu7.3

After a standard system update you need to restart any applications that
use KSSL or KHTML, such as Konqueror, to make all the necessary changes.

  CVE-2011-1094, CVE-2011-1168

Package Information:

Attachment: signature.asc
Description: This is a digitally signed message part