RHSA-2011:0464: kdelibs security update

Description

The kdelibs packages provide libraries for the K Desktop Environment (KDE).A cross-site scripting (XSS) flaw was found in the way KHTML, the HTMLlayout engine used by KDE applications such as the Konqueror web browser,displayed certain error pages. A remote attacker could use this flaw toperform a cross-site scripting attack against victims by tricking them intovisiting a specially-crafted URL. (CVE-2011-1168)A flaw was found in the way kdelibs checked the user specified hostnameagainst the name in the server's SSL certificate. A man-in-the-middleattacker could use this flaw to trick an application using kdelibs intomistakenly accepting a certificate as if it was valid for the host, if thatcertificate was issued for an IP address to which the user specifiedhostname was resolved to. (CVE-2011-1094)Note: As part of the fix for CVE-2011-1094, this update also introducesstricter handling for wildcards used in servers' SSL certificates.Users should upgrade to these updated packages, which contain backportedpatches to correct these issues. The desktop must be restarted (log out,then log back in) for this update to take effect.