Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Debian :: dsa-361.htm

kdelibs, kdelibs-crypto - several vulnerabilities

Debian Security Advisory

DSA-361-2 kdelibs, kdelibs-crypto -- several vulnerabilities

Date Reported:
01 Aug 2003
Affected Packages:
kdelibs, kdelibs-crypto
Security database references:
In Mitre's CVE dictionary: CAN-2003-0459, CAN-2003-0370.
More information:

Two vulnerabilities were discovered in kdelibs:

  • CAN-2003-0459: KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
  • CAN-2003-0370: Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof certificates via a man-in-the-middle attack.

These vulnerabilities are described in the following security advisories from KDE:

For the current stable distribution (woody) these problems have been fixed in version 2.2.2-13.woody.8 of kdelibs and 2.2.2-6woody2 of kdelibs-crypto.

For the unstable distribution (sid) these problems have been fixed in kdelibs version 4:3.1.3-1. The unstable distribution does not contain a separate kdelibs-crypto package.

We recommend that you update your kdelibs and kdelibs-crypto packages.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Architecture-independent component:
Intel IA-32:
Intel IA-64:
Motorola 680x0:
Big endian MIPS:
Little endian MIPS:
IBM S/390:
Sun Sparc:

MD5 checksums of the listed files are available in the original advisory.

MD5 checksums of the listed files are available in the original advisory.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH