[USN-1110-1] KDE-Libs vulnerabilities


========================================================================== Ubuntu Security Notice USN-1110-1 April 14, 2011 kde4libs vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 10.10 - Ubuntu 10.04 LTS - Ubuntu 9.10 Summary: An attacker could send crafted input to Konqueror to view sensitive information. Software Description: - kde4libs: KDE 4 core applications Details: It was discovered that KDE KSSL did not properly verify X.509 certificates when the certificate was issued for an IP address. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2011-1094) Tim Brown discovered that KDE KHTML did not properly escape URLs from externally generated error pages. An attacker could expoit this to conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. (CVE-2011-1168) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 10.10: libkhtml5 4:4.5.1-0ubuntu8.1 libkio5 4:4.5.1-0ubuntu8.1 Ubuntu 10.04 LTS: kdelibs5 4:4.4.5-0ubuntu1.1 Ubuntu 9.10: kdelibs5 4:4.3.2-0ubuntu7.3 After a standard system update you need to restart any applications that use KSSL or KHTML, such as Konqueror, to make all the necessary changes. References: CVE-2011-1094, CVE-2011-1168 Package Information: https://launchpad.net/ubuntu/+source/kde4libs/4:4.5.1-0ubuntu8.1 https://launchpad.net/ubuntu/+source/kde4libs/4:4.4.5-0ubuntu1.1 https://launchpad.net/ubuntu/+source/kde4libs/4:4.3.2-0ubuntu7.3