ID CVE-2014-3494 Type cve Reporter NVD Modified 2015-09-28T20:29:06
Description
kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.
{"result": {"freebsd": [{"lastseen": "2016-09-26T17:24:24", "references": ["http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2"], "affectedPackage": [{"OS": "FreeBSD", "OSVersion": "any", "packageVersion": "4.10.95", "packageName": "kdelibs", "arch": "noarch", "packageFilename": "UNKNOWN", "operator": "eq"}, {"OS": "FreeBSD", "OSVersion": "any", "packageVersion": "4.12.5_2", "packageName": "kdelibs", "arch": "noarch", "packageFilename": "UNKNOWN", "operator": "lt"}], "edition": 1, "description": "\nRichard J. Moore reports:\n\nThe POP3 kioslave used by KMail will accept invalid\n\t certificates without presenting a dialog to the user due a\n\t bug that leads to an inability to display the dialog\n\t combined with an error in the way the result is checked.\nThis flaw allows an active attacker to perform MITM\n\t attacks against the ioslave which could result in the leakage of\n\t sensitive data such as the authentication details and the contents of\n\t emails.\n\n", "reporter": "FreeBSD", "published": "2014-06-17T00:00:00", "title": "kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw", "type": "freebsd", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "bulletinFamily": "unix", "cvelist": ["CVE-2014-3494"], "modified": "2014-06-17T00:00:00", "href": "https://vuxml.freebsd.org/freebsd/4a114331-0d24-11e4-8dd2-5453ed2e2b49.html", "id": "4A114331-0D24-11E4-8DD2-5453ED2E2B49", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "openvas": [{"lastseen": "2018-04-09T11:14:09", "references": ["https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135106.html", "2014-7572"], "pluginID": "1361412562310867947", "description": "Check for the Version of kdelibs", "edition": 3, "reporter": "Copyright (C) 2014 Greenbone Networks GmbH", "published": "2014-07-07T00:00:00", "title": "Fedora Update for kdelibs FEDORA-2014-7572", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-3494"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867947", "id": "OPENVAS:1361412562310867947", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for kdelibs FEDORA-2014-7572\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867947\");\n script_version(\"$Revision: 9373 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:57:18 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2014-07-07 12:29:34 +0530 (Mon, 07 Jul 2014)\");\n script_cve_id(\"CVE-2014-3494\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for kdelibs FEDORA-2014-7572\");\n\n tag_insight = \"Libraries for KDE 4.\n\";\n\n tag_affected = \"kdelibs on Fedora 19\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2014-7572\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135106.html\");\n script_tag(name:\"summary\", value:\"Check for the Version of kdelibs\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"kdelibs\", rpm:\"kdelibs~4.11.5~4.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2018-04-09T11:11:53", "references": ["2014-7579", "https://lists.fedoraproject.org/pipermail/package-announce/2014-July/134961.html"], "pluginID": "1361412562310867935", "description": "Check for the Version of kdelibs", "edition": 3, "reporter": "Copyright (C) 2014 Greenbone Networks GmbH", "published": "2014-07-01T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Fedora Update for kdelibs FEDORA-2014-7579", "type": "openvas", "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-3494"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310867935", "id": "OPENVAS:1361412562310867935", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for kdelibs FEDORA-2014-7579\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.867935\");\n script_version(\"$Revision: 9373 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:57:18 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2014-07-01 15:59:13 +0530 (Tue, 01 Jul 2014)\");\n script_cve_id(\"CVE-2014-3494\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_name(\"Fedora Update for kdelibs FEDORA-2014-7579\");\n\n tag_insight = \"Libraries for KDE 4.\n\";\n\n tag_affected = \"kdelibs on Fedora 20\";\n\n tag_solution = \"Please Install the Updated Packages.\";\n\n\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2014-7579\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2014-July/134961.html\");\n script_tag(name:\"summary\", value:\"Check for the Version of kdelibs\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"kdelibs\", rpm:\"kdelibs~4.12.5~4.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-07-31T10:49:01", "references": ["2014-11348", "https://lists.fedoraproject.org/pipermail/package-announce/2014-October/140293.html"], "pluginID": "1361412562310868372", "description": "Check the version of kdelibs", "edition": 3, "reporter": "Copyright (C) 2014 Greenbone Networks GmbH", "published": "2014-10-11T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "title": "Fedora Update for kdelibs FEDORA-2014-11348", "type": "openvas", "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-5033", "CVE-2014-3494"], "modified": "2017-07-14T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868372", "id": "OPENVAS:1361412562310868372", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for kdelibs FEDORA-2014-11348\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868372\");\n script_version(\"$Revision: 6724 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-14 11:57:17 +0200 (Fri, 14 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2014-10-11 05:57:05 +0200 (Sat, 11 Oct 2014)\");\n script_cve_id(\"CVE-2014-5033\", \"CVE-2014-3494\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Update for kdelibs FEDORA-2014-11348\");\n script_tag(name: \"summary\", value: \"Check the version of kdelibs\");\n script_tag(name: \"vuldetect\", value: \"Get the installed version with the help of detect NVT and check if the version is vulnerable or not.\");\n script_tag(name: \"insight\", value: \"Libraries for KDE 4.\n\");\n script_tag(name: \"affected\", value: \"kdelibs on Fedora 19\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name: \"FEDORA\", value: \"2014-11348\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2014-October/140293.html\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"kdelibs\", rpm:\"kdelibs~4.11.5~5.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-09T11:12:19", "references": ["https://lists.fedoraproject.org/pipermail/package-announce/2014-September/138758.html", "2014-11448"], "pluginID": "1361412562310868320", "description": "Check for the Version of kdelibs", "edition": 3, "reporter": "Copyright (C) 2014 Greenbone Networks GmbH", "published": "2014-10-01T00:00:00", "title": "Fedora Update for kdelibs FEDORA-2014-11448", "type": "openvas", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-0191", "CVE-2014-5033", "CVE-2014-3494"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868320", "id": "OPENVAS:1361412562310868320", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for kdelibs FEDORA-2014-11448\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868320\");\n script_version(\"$Revision: 9373 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:57:18 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2014-10-01 16:57:37 +0530 (Wed, 01 Oct 2014)\");\n script_cve_id(\"CVE-2014-5033\", \"CVE-2014-3494\", \"CVE-2014-0191\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Update for kdelibs FEDORA-2014-11448\");\n script_tag(name: \"insight\", value: \"Libraries for KDE 4.\n\");\n script_tag(name: \"affected\", value: \"kdelibs on Fedora 20\");\n script_tag(name: \"solution\", value: \"Please Install the Updated Packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_xref(name: \"FEDORA\", value: \"2014-11448\");\n script_xref(name: \"URL\" , value: \"https://lists.fedoraproject.org/pipermail/package-announce/2014-September/138758.html\");\n script_tag(name:\"summary\", value:\"Check for the Version of kdelibs\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"kdelibs\", rpm:\"kdelibs~4.14.1~1.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-09T11:24:57", "references": ["https://security.gentoo.org/glsa/201406-34"], "pluginID": "1361412562310121237", "description": "Gentoo Linux Local Security Checks https://security.gentoo.org/glsa/201406-34", "edition": 3, "reporter": "Eero Volotinen", "published": "2015-09-29T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "title": "Gentoo Linux Local Check: https://security.gentoo.org/glsa/201406-34", "type": "openvas", "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-2074", "CVE-2014-3494", "CVE-2011-1094", "CVE-2011-3365"], "modified": "2018-04-06T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121237", "id": "OPENVAS:1361412562310121237", "sourceData": "# OpenVAS Vulnerability Test\n# Description: Gentoo Linux security check\n# $Id: glsa-201406-34.nasl 9374 2018-04-06 08:58:12Z cfischer $\n\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\nif(description)\n {\nscript_oid(\"1.3.6.1.4.1.25623.1.0.121237\");\nscript_version(\"$Revision: 9374 $\");\nscript_tag(name:\"creation_date\", value:\"2015-09-29 11:27:37 +0300 (Tue, 29 Sep 2015)\");\nscript_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:58:12 +0200 (Fri, 06 Apr 2018) $\");\nscript_name(\"Gentoo Linux Local Check: https://security.gentoo.org/glsa/201406-34\");\nscript_tag(name: \"insight\", value: \"Multiple vulnerabilities have been discovered in KDE Libraries. Please review the CVE identifiers referenced below for details.\"); \nscript_tag(name : \"solution\", value : \"update software\");\nscript_tag(name : \"solution_type\", value : \"VendorFix\");\nscript_xref(name : \"URL\" , value : \"https://security.gentoo.org/glsa/201406-34\");\nscript_cve_id(\"CVE-2011-1094\",\"CVE-2011-3365\",\"CVE-2013-2074\",\"CVE-2014-3494\");\nscript_tag(name:\"cvss_base\", value:\"5.0\");\nscript_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\nscript_tag(name:\"qod_type\", value:\"package\");\nscript_dependencies(\"gather-package-list.nasl\");\nscript_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\nscript_category(ACT_GATHER_INFO);\nscript_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks https://security.gentoo.org/glsa/201406-34\");\nscript_copyright(\"Eero Volotinen\");\nscript_family(\"Gentoo Local Security Checks\");\nexit(0);\n}\ninclude(\"revisions-lib.inc\");\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"kde-base/kdelibs\", unaffected: make_list(\"ge 4.12.5-r1\"), vulnerable: make_list(\"lt 4.12.5-r1\"))) != NULL) {\n\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "nessus": [{"lastseen": "2017-10-29T13:35:44", "references": ["http://www.nessus.org/u?e395d0b7", "https://bugzilla.redhat.com/show_bug.cgi?id=1111022"], "pluginID": "76374", "description": "Fix security issue where POP3 kioslave silently accepted invalid SSL certificates.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 2, "reporter": "Tenable", "published": "2014-07-06T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "type": "nessus", "title": "Fedora 19 : kdelibs-4.11.5-4.fc19 (2014-7572)", "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-3494"], "cpe": ["cpe:/o:fedoraproject:fedora:19", "p-cpe:/a:fedoraproject:fedora:kdelibs"], "modified": "2015-10-19T00:00:00", "id": "FEDORA_2014-7572.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76374", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-7572.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76374);\n script_version(\"$Revision: 1.3 $\");\n script_cvs_date(\"$Date: 2015/10/19 22:40:32 $\");\n\n script_cve_id(\"CVE-2014-3494\");\n script_bugtraq_id(68113);\n script_xref(name:\"FEDORA\", value:\"2014-7572\");\n\n script_name(english:\"Fedora 19 : kdelibs-4.11.5-4.fc19 (2014-7572)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix security issue where POP3 kioslave silently accepted invalid SSL\ncertificates.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1111022\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135106.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e395d0b7\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kdelibs package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kdelibs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/06/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"kdelibs-4.11.5-4.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kdelibs\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-10-29T13:45:34", "references": ["http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2", "http://www.nessus.org/u?5765a846"], "pluginID": "76543", "description": "Richard J. Moore reports :\n\nThe POP3 kioslave used by KMail will accept invalid certificates without presenting a dialog to the user due a bug that leads to an inability to display the dialog combined with an error in the way the result is checked.\n\nThis flaw allows an active attacker to perform MITM attacks against the ioslave which could result in the leakage of sensitive data such as the authentication details and the contents of emails.", "edition": 2, "reporter": "Tenable", "published": "2014-07-17T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "type": "nessus", "title": "FreeBSD : kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw (4a114331-0d24-11e4-8dd2-5453ed2e2b49)", "naslFamily": "FreeBSD Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-3494"], "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:kdelibs"], "modified": "2014-07-17T00:00:00", "id": "FREEBSD_PKG_4A1143310D2411E48DD25453ED2E2B49.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76543", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2014 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76543);\n script_version(\"$Revision: 1.1 $\");\n script_cvs_date(\"$Date: 2014/07/17 10:45:05 $\");\n\n script_cve_id(\"CVE-2014-3494\");\n script_bugtraq_id(68113);\n\n script_name(english:\"FreeBSD : kdelibs4 -- KMail/KIO POP3 SSL Man-in-the-middle Flaw (4a114331-0d24-11e4-8dd2-5453ed2e2b49)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Richard J. Moore reports :\n\nThe POP3 kioslave used by KMail will accept invalid certificates\nwithout presenting a dialog to the user due a bug that leads to an\ninability to display the dialog combined with an error in the way the\nresult is checked.\n\nThis flaw allows an active attacker to perform MITM attacks against\nthe ioslave which could result in the leakage of sensitive data such\nas the authentication details and the contents of emails.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://lists.kde.org/?l=kde-announce&m=140312275318160&w=2\"\n );\n # http://www.freebsd.org/ports/portaudit/4a114331-0d24-11e4-8dd2-5453ed2e2b49.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?5765a846\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:kdelibs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2014/06/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014 Tenable Network Security, Inc.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"kdelibs>=4.10.95<4.12.5_2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-10-29T13:39:51", "references": ["http://www.nessus.org/u?30b9be9f", "https://bugzilla.redhat.com/show_bug.cgi?id=1111022"], "pluginID": "76334", "description": "Fix security issue where POP3 kioslave silently accepted invalid SSL certificates.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 2, "reporter": "Tenable", "published": "2014-07-02T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "type": "nessus", "title": "Fedora 20 : kdelibs-4.12.5-4.fc20 (2014-7579)", "naslFamily": "Fedora Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-3494"], "cpe": ["p-cpe:/a:fedoraproject:fedora:kdelibs", "cpe:/o:fedoraproject:fedora:20"], "modified": "2015-10-19T00:00:00", "id": "FEDORA_2014-7579.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76334", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-7579.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76334);\n script_version(\"$Revision: 1.3 $\");\n script_cvs_date(\"$Date: 2015/10/19 22:40:32 $\");\n\n script_cve_id(\"CVE-2014-3494\");\n script_bugtraq_id(68113);\n script_xref(name:\"FEDORA\", value:\"2014-7579\");\n\n script_name(english:\"Fedora 20 : kdelibs-4.12.5-4.fc20 (2014-7579)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fix security issue where POP3 kioslave silently accepted invalid SSL\ncertificates.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1111022\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-July/134961.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?30b9be9f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kdelibs package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:kdelibs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/06/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/07/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"kdelibs-4.12.5-4.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kdelibs\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-10-29T13:36:05", "references": ["https://security.gentoo.org/glsa/201406-34"], "pluginID": "76305", "edition": 2, "description": "The remote host is affected by the vulnerability described in GLSA-201406-34 (KDE Libraries: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in KDE Libraries. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker could cause a man-in-the-middle attack via any certificate issued by a legitimate certification authority. Furthermore, a local attacker may gain knowledge of user passwords through an information leak.\n Workaround :\n\n There is no known workaround at this time.", "reporter": "Tenable", "published": "2014-06-30T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "type": "nessus", "title": "GLSA-201406-34 : KDE Libraries: Multiple vulnerabilities", "naslFamily": "Gentoo Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2013-2074", "CVE-2014-3494", "CVE-2011-1094", "CVE-2011-3365"], "cpe": ["p-cpe:/a:gentoo:linux:kdelibs", "cpe:/o:gentoo:linux"], "modified": "2015-04-13T00:00:00", "id": "GENTOO_GLSA-201406-34.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76305", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201406-34.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76305);\n script_version(\"$Revision: 1.3 $\");\n script_cvs_date(\"$Date: 2015/04/13 14:27:08 $\");\n\n script_cve_id(\"CVE-2011-1094\", \"CVE-2011-3365\", \"CVE-2013-2074\", \"CVE-2014-3494\");\n script_bugtraq_id(46789, 49925, 59808, 68113);\n script_xref(name:\"GLSA\", value:\"201406-34\");\n\n script_name(english:\"GLSA-201406-34 : KDE Libraries: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201406-34\n(KDE Libraries: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in KDE Libraries. Please\n review the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could cause a man-in-the-middle attack via any\n certificate issued by a legitimate certification authority. Furthermore,\n a local attacker may gain knowledge of user passwords through an\n information leak.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201406-34\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All KDE users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=kde-base/kdelibs-4.12.5-r1'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:kdelibs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/06/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/06/30\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2015 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"kde-base/kdelibs\", unaffected:make_list(\"ge 4.12.5-r1\"), vulnerable:make_list(\"lt 4.12.5-r1\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"KDE Libraries\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}, {"lastseen": "2017-10-29T13:42:16", "references": ["https://bugzilla.opensuse.org/show_bug.cgi?id=902670", "https://bugzilla.opensuse.org/show_bug.cgi?id=883374", "https://bugzilla.opensuse.org/show_bug.cgi?id=905742", "https://bugzilla.opensuse.org/show_bug.cgi?id=875470", "https://bugzilla.opensuse.org/show_bug.cgi?id=921999"], "pluginID": "82014", "edition": 2, "description": "KDE and QT were updated to fix security issues and bugs.\n\nThe following vulerabilities were fixed :\n\n - CVE-2014-0190: Malformed GIF files could have crashed QT based applications\n\n - CVE-2015-0295: Malformed BMP files could have crashed QT based applications\n\n - CVE-2014-8600: Multiple cross-site scripting (XSS) vulnerabilities in the KDE runtime could have allowed remote attackers to insert arbitrary web script or HTML via crafted URIs using one of several supported URL schemes\n\n - CVE-2014-8483: A missing size check in the Blowfish ECB could have lead to a crash of Konversation or 11 byte information leak\n\n - CVE-2014-3494: The KMail POP3 kioslave accepted invalid certifiates and allowed a man-in-the-middle (MITM) attack\n\nAdditionally, Konversation was updated to 1.5.1 to fix bugs.", "reporter": "Tenable", "published": "2015-03-24T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "type": "nessus", "title": "openSUSE Security Update : kdebase4-runtime / kdelibs4 / konversation / etc (openSUSE-2015-251)", "naslFamily": "SuSE Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2014-3494", "CVE-2014-0190", "CVE-2014-8483", "CVE-2015-0295", "CVE-2014-8600"], "cpe": ["p-cpe:/a:novell:opensuse:libqt4-qt3support-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libqt4-x11", "p-cpe:/a:novell:opensuse:libkde4-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libqt4-sql-sqlite", "p-cpe:/a:novell:opensuse:libqt4-linguist-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-sql-mysql", "p-cpe:/a:novell:opensuse:libqt4-sql-postgresql", "p-cpe:/a:novell:opensuse:libqt4-sql-postgresql-debuginfo", "p-cpe:/a:novell:opensuse:libksuseinstall1-debuginfo", "p-cpe:/a:novell:opensuse:libkdecore4-devel-debuginfo", "p-cpe:/a:novell:opensuse:kdelibs4-doc-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC-debuginfo-32bit", "p-cpe:/a:novell:opensuse:konversation-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-sql-mysql-32bit", "p-cpe:/a:novell:opensuse:libksuseinstall1-32bit", "p-cpe:/a:novell:opensuse:libkde4-devel", "p-cpe:/a:novell:opensuse:libkdecore4-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-debugsource", "p-cpe:/a:novell:opensuse:libqt4-sql-postgresql-32bit", "p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC", "p-cpe:/a:novell:opensuse:qt4-x11-tools", "p-cpe:/a:novell:opensuse:libqt4-sql-sqlite-debuginfo", "p-cpe:/a:novell:opensuse:kdebase4-runtime", "p-cpe:/a:novell:opensuse:kdebase4-runtime-devel", "p-cpe:/a:novell:opensuse:kwebkitpart", "p-cpe:/a:novell:opensuse:libqt4-sql-sqlite-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libksuseinstall1-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libqt4-qt3support-debuginfo", "p-cpe:/a:novell:opensuse:libkdecore4-devel", "p-cpe:/a:novell:opensuse:libqt4-devel-doc-debuginfo", "p-cpe:/a:novell:opensuse:konversation-lang", "p-cpe:/a:novell:opensuse:libkde4-32bit", "p-cpe:/a:novell:opensuse:libqt4-devel", "p-cpe:/a:novell:opensuse:libqt4-qt3support-32bit", "p-cpe:/a:novell:opensuse:libksuseinstall1", "p-cpe:/a:novell:opensuse:libkdecore4-32bit", "p-cpe:/a:novell:opensuse:kdebase4-runtime-branding-upstream", "p-cpe:/a:novell:opensuse:kdelibs4-core-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-sql", "p-cpe:/a:novell:opensuse:libkde4-debuginfo", "p-cpe:/a:novell:opensuse:qt4-x11-tools-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-private-headers-devel", "p-cpe:/a:novell:opensuse:libqt4-sql-mysql-debuginfo", "p-cpe:/a:novell:opensuse:konversation", "p-cpe:/a:novell:opensuse:kdelibs4-core", "p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC-32bit", "p-cpe:/a:novell:opensuse:kwebkitpart-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-devel-debuginfo", "p-cpe:/a:novell:opensuse:libkdecore4-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libqt4-devel-doc-data", "p-cpe:/a:novell:opensuse:kdelibs4-apidocs", "p-cpe:/a:novell:opensuse:libqt4-sql-postgresql-debuginfo-32bit", "p-cpe:/a:novell:opensuse:kwebkitpart-lang", "p-cpe:/a:novell:opensuse:libqt4-sql-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC-debuginfo", "p-cpe:/a:novell:opensuse:kdelibs4-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-linguist", "p-cpe:/a:novell:opensuse:plasma-theme-oxygen", "p-cpe:/a:novell:opensuse:kdebase4-runtime-debugsource", "p-cpe:/a:novell:opensuse:konversation-debugsource", "p-cpe:/a:novell:opensuse:kdelibs4-branding-upstream", "p-cpe:/a:novell:opensuse:libksuseinstall-devel", "p-cpe:/a:novell:opensuse:libqt4-x11-32bit", "p-cpe:/a:novell:opensuse:libqt4-sql-debuginfo", "p-cpe:/a:novell:opensuse:kdelibs4-debugsource", "p-cpe:/a:novell:opensuse:libqt4-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libkde4", "p-cpe:/a:novell:opensuse:libqt4-32bit", "p-cpe:/a:novell:opensuse:libqt4", "p-cpe:/a:novell:opensuse:kdebase4-runtime-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-devel-doc-debugsource", "p-cpe:/a:novell:opensuse:libkdecore4", "p-cpe:/a:novell:opensuse:libqt4-sql-32bit", "p-cpe:/a:novell:opensuse:kwebkitpart-debugsource", "p-cpe:/a:novell:opensuse:libqt4-x11-debuginfo", "p-cpe:/a:novell:opensuse:libqt4-x11-debuginfo-32bit", "cpe:/o:novell:opensuse:13.1", "p-cpe:/a:novell:opensuse:libqt4-qt3support", "p-cpe:/a:novell:opensuse:libqt4-sql-sqlite-32bit", "p-cpe:/a:novell:opensuse:libqt4-sql-mysql-debuginfo-32bit", "p-cpe:/a:novell:opensuse:libqt4-sql-plugins-debugsource", "p-cpe:/a:novell:opensuse:kdelibs4"], "modified": "2015-03-24T00:00:00", "id": "OPENSUSE-2015-251.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=82014", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2015-251.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(82014);\n script_version(\"$Revision: 1.1 $\");\n script_cvs_date(\"$Date: 2015/03/24 13:22:29 $\");\n\n script_cve_id(\"CVE-2014-0190\", \"CVE-2014-3494\", \"CVE-2014-8483\", \"CVE-2014-8600\", \"CVE-2015-0295\");\n\n script_name(english:\"openSUSE Security Update : kdebase4-runtime / kdelibs4 / konversation / etc (openSUSE-2015-251)\");\n script_summary(english:\"Check for the openSUSE-2015-251 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"KDE and QT were updated to fix security issues and bugs.\n\nThe following vulerabilities were fixed :\n\n - CVE-2014-0190: Malformed GIF files could have crashed QT\n based applications\n\n - CVE-2015-0295: Malformed BMP files could have crashed QT\n based applications\n\n - CVE-2014-8600: Multiple cross-site scripting (XSS)\n vulnerabilities in the KDE runtime could have allowed\n remote attackers to insert arbitrary web script or HTML\n via crafted URIs using one of several supported URL\n schemes\n\n - CVE-2014-8483: A missing size check in the Blowfish ECB\n could have lead to a crash of Konversation or 11 byte\n information leak\n\n - CVE-2014-3494: The KMail POP3 kioslave accepted invalid\n certifiates and allowed a man-in-the-middle (MITM)\n attack\n\nAdditionally, Konversation was updated to 1.5.1 to fix bugs.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=875470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=883374\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=902670\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=905742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=921999\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected kdebase4-runtime / kdelibs4 / konversation / etc packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdebase4-runtime\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdebase4-runtime-branding-upstream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdebase4-runtime-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdebase4-runtime-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdebase4-runtime-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4-apidocs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4-branding-upstream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4-core\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4-core-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kdelibs4-doc-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:konversation\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:konversation-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:konversation-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:konversation-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kwebkitpart\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kwebkitpart-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kwebkitpart-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:kwebkitpart-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkde4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkde4-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkde4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkde4-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkde4-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkdecore4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkdecore4-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkdecore4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkdecore4-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkdecore4-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libkdecore4-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libksuseinstall-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libksuseinstall1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libksuseinstall1-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libksuseinstall1-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libksuseinstall1-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-devel-doc-data\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-devel-doc-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-devel-doc-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-linguist\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-linguist-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-private-headers-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-qt3support\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-qt3support-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-qt3support-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-qt3support-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-mysql-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-mysql-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-mysql-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-plugins-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-postgresql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-postgresql-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-postgresql-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-postgresql-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-sqlite\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-sqlite-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-sqlite-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-sqlite-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-sql-unixODBC-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-x11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-x11-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-x11-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libqt4-x11-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:plasma-theme-oxygen\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qt4-x11-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:qt4-x11-tools-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/03/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdebase4-runtime-4.11.5-482.6\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdebase4-runtime-branding-upstream-4.11.5-482.6\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdebase4-runtime-debuginfo-4.11.5-482.6\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdebase4-runtime-debugsource-4.11.5-482.6\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdebase4-runtime-devel-4.11.5-482.6\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-apidocs-4.11.5-488.3\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-branding-upstream-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-core-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-core-debuginfo-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-debuginfo-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-debugsource-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kdelibs4-doc-debuginfo-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"konversation-1.5.1-3.4.3\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"konversation-debuginfo-1.5.1-3.4.3\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"konversation-debugsource-1.5.1-3.4.3\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"konversation-lang-1.5.1-3.4.3\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kwebkitpart-1.3.3-2.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kwebkitpart-debuginfo-1.3.3-2.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kwebkitpart-debugsource-1.3.3-2.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"kwebkitpart-lang-1.3.3-2.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libkde4-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libkde4-debuginfo-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libkde4-devel-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libkdecore4-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libkdecore4-debuginfo-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libkdecore4-devel-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libkdecore4-devel-debuginfo-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libksuseinstall-devel-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libksuseinstall1-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libksuseinstall1-debuginfo-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-debugsource-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-devel-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-devel-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-devel-doc-data-4.8.5-5.17.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-devel-doc-debuginfo-4.8.5-5.17.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-devel-doc-debugsource-4.8.5-5.17.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-linguist-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-linguist-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-private-headers-devel-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-qt3support-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-qt3support-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-mysql-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-mysql-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-plugins-debugsource-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-postgresql-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-postgresql-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-sqlite-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-sqlite-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-unixODBC-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-sql-unixODBC-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-x11-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libqt4-x11-debuginfo-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"plasma-theme-oxygen-4.11.5-482.6\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"qt4-x11-tools-4.8.5-5.17.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"qt4-x11-tools-debuginfo-4.8.5-5.17.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libkde4-32bit-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libkde4-debuginfo-32bit-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libkdecore4-32bit-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libkdecore4-debuginfo-32bit-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libksuseinstall1-32bit-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libksuseinstall1-debuginfo-32bit-4.11.5-488.2\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-qt3support-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-qt3support-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-mysql-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-mysql-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-postgresql-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-postgresql-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-sqlite-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-sqlite-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-unixODBC-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-sql-unixODBC-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-x11-32bit-4.8.5-5.17.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libqt4-x11-debuginfo-32bit-4.8.5-5.17.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"kdebase4-runtime / kdebase4-runtime-branding-upstream / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:45", "references": ["https://bugs.gentoo.org/show_bug.cgi?id=469140", "https://bugs.gentoo.org/show_bug.cgi?id=358025", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3365", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2074", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3494", "https://bugs.gentoo.org/show_bug.cgi?id=513726", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1094", "https://bugs.gentoo.org/show_bug.cgi?id=384227"], "affectedPackage": [{"OS": "Gentoo", "OSVersion": "any", "packageVersion": "4.12.5-r1", "arch": "all", "packageFilename": "UNKNOWN", "packageName": "kde-base/kdelibs", "operator": "lt"}], "edition": 1, "description": "### Background\n\nKDE is a feature-rich graphical desktop environment for Linux and Unix-like operating systems. KDE Libraries contains libraries needed by all KDE applications. \n\n### Description\n\nMultiple vulnerabilities have been discovered in KDE Libraries. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could cause a man-in-the-middle attack via any certificate issued by a legitimate certification authority. Furthermore, a local attacker may gain knowledge of user passwords through an information leak. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll KDE users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=kde-base/kdelibs-4.12.5-r1\"", "reporter": "Gentoo Foundation", "published": "2014-06-29T00:00:00", "enchantments": {"score": {"vector": "NONE", "value": 2.1}}, "type": "gentoo", "title": "KDE Libraries: Multiple vulnerabilities", "bulletinFamily": "unix", "cvelist": ["CVE-2013-2074", "CVE-2014-3494", "CVE-2011-1094", "CVE-2011-3365"], "modified": "2014-06-29T00:00:00", "id": "GLSA-201406-34", "href": "https://security.gentoo.org/glsa/201406-34", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}]}}
