kdelibs - arbitrary program execution

The KDE team has
discovered a vulnerability in the support for various
network protocols via the KIO. The implementation of the rlogin and telnet
protocols allows a carefully crafted URL in an HTML page, HTML email or
other KIO-enabled application to execute arbitrary commands on the
system using the victim’s account on the vulnerable machine.

This problem has been fixed by disabling rlogin and telnet in version
2.2.2-13.woody.5 for the current stable distribution (woody). The old
stable distribution (potato) is not affected since it doesn’t contain
KDE. A correction for the package in the unstable distribution (sid)
is not yet available.

We recommend that you upgrade your kdelibs3 package immediately.