Rapid7 Vulnerability & Exploit Database

RHSA-2011:0464: kdelibs security update

Back to Search

RHSA-2011:0464: kdelibs security update

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
04/18/2011
Created
07/25/2018
Added
05/12/2011
Modified
07/04/2017

Description

The kdelibs packages provide libraries for the K Desktop Environment (KDE).A cross-site scripting (XSS) flaw was found in the way KHTML, the HTMLlayout engine used by KDE applications such as the Konqueror web browser,displayed certain error pages. A remote attacker could use this flaw toperform a cross-site scripting attack against victims by tricking them intovisiting a specially-crafted URL. (CVE-2011-1168)A flaw was found in the way kdelibs checked the user specified hostnameagainst the name in the server's SSL certificate. A man-in-the-middleattacker could use this flaw to trick an application using kdelibs intomistakenly accepting a certificate as if it was valid for the host, if thatcertificate was issued for an IP address to which the user specifiedhostname was resolved to. (CVE-2011-1094)Note: As part of the fix for CVE-2011-1094, this update also introducesstricter handling for wildcards used in servers' SSL certificates.Users should upgrade to these updated packages, which contain backportedpatches to correct these issues. The desktop must be restarted (log out,then log back in) for this update to take effect.

Solution(s)

  • redhat-upgrade-kdelibs
  • redhat-upgrade-kdelibs-apidocs
  • redhat-upgrade-kdelibs-common
  • redhat-upgrade-kdelibs-debuginfo
  • redhat-upgrade-kdelibs-devel

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;