Skip to navigation

Security Advisory kdelibs, kdebase security update

Advisory: RHSA-2005:009-19
Type: Security Advisory
Severity: Important
Issued on: 2005-02-10
Last updated on: 2005-02-10
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 2.1)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org): CVE-2004-1158
CVE-2004-1165
CVE-2005-0078

Details

Updated kdelib and kdebase packages that resolve several security issues
are now available.

The kdelibs packages include libraries for the K Desktop Environment. The
kdebase packages include core applications for the K Desktop Environment.

Secunia Research discovered a window injection spoofing vulnerability
affecting the Konqueror web browser. This issue could allow a malicious
website to show arbitrary content in a different browser window. The Common
Vulnerabilities and Exposures project has assigned the name CAN-2004-1158
to this issue.

A bug was discovered in the way kioslave handles URL-encoded newline (%0a)
characters before the FTP command. It is possible that a specially crafted
URL could be used to execute any ftp command on a remote server, or
potentially send unsolicited email. The Common Vulnerabilities and
Exposures project has assigned the name CAN-2004-1165 to this issue.

A bug was discovered that can crash KDE screensaver under certain local
circumstances. This could allow an attacker with physical access to the
workstation to take over a locked desktop session. Please note that this
issue only affects Red Hat Enterprise Linux 2.1. The Common Vulnerabilities
and Exposures project has assigned the name CAN-2005-0078 to this issue.

All users of KDE are advised to upgrade to this updated packages, which
contain backported patches to correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 3)

IA-32:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-devel-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: a66570d58774ae59253985e9089f7074
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-devel-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 65ff2276ebd06a84363734aac1e819c2
 
x86_64:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 85c1ebcce8e37502e4c57ac5666bd5b6
kdebase-devel-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: cc159d0af68f93775029e72c98fa67cd
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: ea4f3a20b3b90e64c065dd1a43047f01
kdelibs-devel-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 8c99f2100c9f3e5b03efff7165eff15c
 
Red Hat Enterprise Linux AS (v. 2.1)

IA-32:
arts-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 4d38bae519a161f1452bb554fb04ba81
ftp://updates.redhat.com/rhn/repository/NULL/kdebase/2.2.2-15/i386/kdebase-2.2.2-15.i386.rpm
Missing file
    MD5: 030a200855eb2be8bdc42800eeb06cef
ftp://updates.redhat.com/rhn/repository/NULL/kdebase-devel/2.2.2-15/i386/kdebase-devel-2.2.2-15.i386.rpm
Missing file
    MD5: 774d4f3c8b056b807279149410432482
kdelibs-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: bb8d504cb0c377299863c4b5a49fdeab
kdelibs-devel-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 5cdcc1ff323a76d713de8b602a8681e5
kdelibs-sound-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 134afda3f20237a143a48b05efa19ce3
kdelibs-sound-devel-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: f4be4258a190a5dcf32c4c9cd338d9f9
 
IA-64:
arts-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: 29b839c2620301ae2abfc6f26511e64e
ftp://updates.redhat.com/rhn/repository/NULL/kdebase/2.2.2-15/ia64/kdebase-2.2.2-15.ia64.rpm
Missing file
    MD5: aceb3a74103fd439be563eb1c5346890
ftp://updates.redhat.com/rhn/repository/NULL/kdebase-devel/2.2.2-15/ia64/kdebase-devel-2.2.2-15.ia64.rpm
Missing file
    MD5: 8b5de25703a71498f6ce9c316a7be391
kdelibs-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: ebd5bc9dd5419cf9dc00e8c663e0b722
kdelibs-devel-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: 6788128e0c457af8c7531f4ad4cf0620
kdelibs-sound-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: 0eced9a280854ff5a56cf9248778aa91
kdelibs-sound-devel-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: c30d0494f359483f5ea45c216a75fb83
 
Red Hat Enterprise Linux AS (v. 3)

IA-32:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-devel-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: a66570d58774ae59253985e9089f7074
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-devel-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 65ff2276ebd06a84363734aac1e819c2
 
IA-64:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-3.1.3-5.8.ia64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 3fff6529152bac165097691689afd5ae
kdebase-devel-3.1.3-5.8.ia64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 9e9245aceb7cb8d4422f91798ee47fcf
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-3.1.3-6.9.ia64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 3ff097e232c2c1ecd0a8684c8b526581
kdelibs-devel-3.1.3-6.9.ia64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 155776d1b23d3c1c881f805416ecc9fa
 
PPC:
kdebase-3.1.3-5.8.ppc.rpm
File outdated by:  RHSA-2007:0494
    MD5: 0fc9e4a1708c61b2206768e1394ecebd
kdebase-3.1.3-5.8.ppc64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 72499cac48e0a01419aab74f7ede3aac
kdebase-devel-3.1.3-5.8.ppc.rpm
File outdated by:  RHSA-2007:0494
    MD5: 2dd6ee38cd14fa2fe23738288ccbedba
kdelibs-3.1.3-6.9.ppc.rpm
File outdated by:  RHSA-2009:1128
    MD5: 4a16bc2c6e43daab1e89c2325524b05a
kdelibs-3.1.3-6.9.ppc64.rpm
File outdated by:  RHSA-2009:1128
    MD5: e90b5b1341b2b3b377ffd29ae77f851a
kdelibs-devel-3.1.3-6.9.ppc.rpm
File outdated by:  RHSA-2009:1128
    MD5: e502d549dfd189d1adc737ec8465b891
 
s390:
kdebase-3.1.3-5.8.s390.rpm
File outdated by:  RHSA-2007:0494
    MD5: f0a4e0e6fdf9eee9f2825da3736a7885
kdebase-devel-3.1.3-5.8.s390.rpm
File outdated by:  RHSA-2007:0494
    MD5: 2147f372980f4df3d112545c3de5c0a8
kdelibs-3.1.3-6.9.s390.rpm
File outdated by:  RHSA-2009:1128
    MD5: 3a4b1bc5571900b494af7082ab7a1a13
kdelibs-devel-3.1.3-6.9.s390.rpm
File outdated by:  RHSA-2009:1128
    MD5: bf90245b516428c7d9ef4cf0cef37342
 
s390x:
kdebase-3.1.3-5.8.s390.rpm
File outdated by:  RHSA-2007:0494
    MD5: f0a4e0e6fdf9eee9f2825da3736a7885
kdebase-3.1.3-5.8.s390x.rpm
File outdated by:  RHSA-2007:0494
    MD5: 755768f2b7ad338f8d66aaa05d66cec7
kdebase-devel-3.1.3-5.8.s390x.rpm
File outdated by:  RHSA-2007:0494
    MD5: cfd77c86b6f3a565c5799b057fbb5798
kdelibs-3.1.3-6.9.s390.rpm
File outdated by:  RHSA-2009:1128
    MD5: 3a4b1bc5571900b494af7082ab7a1a13
kdelibs-3.1.3-6.9.s390x.rpm
File outdated by:  RHSA-2009:1128
    MD5: 4273cbc141a3c025b40a121a320f569e
kdelibs-devel-3.1.3-6.9.s390x.rpm
File outdated by:  RHSA-2009:1128
    MD5: 050516f5c80f0cc06466d8698bef3833
 
x86_64:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 85c1ebcce8e37502e4c57ac5666bd5b6
kdebase-devel-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: cc159d0af68f93775029e72c98fa67cd
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: ea4f3a20b3b90e64c065dd1a43047f01
kdelibs-devel-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 8c99f2100c9f3e5b03efff7165eff15c
 
Red Hat Enterprise Linux ES (v. 2.1)

IA-32:
arts-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 4d38bae519a161f1452bb554fb04ba81
ftp://updates.redhat.com/rhn/repository/NULL/kdebase/2.2.2-15/i386/kdebase-2.2.2-15.i386.rpm
Missing file
    MD5: 030a200855eb2be8bdc42800eeb06cef
ftp://updates.redhat.com/rhn/repository/NULL/kdebase-devel/2.2.2-15/i386/kdebase-devel-2.2.2-15.i386.rpm
Missing file
    MD5: 774d4f3c8b056b807279149410432482
kdelibs-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: bb8d504cb0c377299863c4b5a49fdeab
kdelibs-devel-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 5cdcc1ff323a76d713de8b602a8681e5
kdelibs-sound-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 134afda3f20237a143a48b05efa19ce3
kdelibs-sound-devel-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: f4be4258a190a5dcf32c4c9cd338d9f9
 
Red Hat Enterprise Linux ES (v. 3)

IA-32:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-devel-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: a66570d58774ae59253985e9089f7074
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-devel-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 65ff2276ebd06a84363734aac1e819c2
 
IA-64:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-3.1.3-5.8.ia64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 3fff6529152bac165097691689afd5ae
kdebase-devel-3.1.3-5.8.ia64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 9e9245aceb7cb8d4422f91798ee47fcf
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-3.1.3-6.9.ia64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 3ff097e232c2c1ecd0a8684c8b526581
kdelibs-devel-3.1.3-6.9.ia64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 155776d1b23d3c1c881f805416ecc9fa
 
x86_64:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 85c1ebcce8e37502e4c57ac5666bd5b6
kdebase-devel-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: cc159d0af68f93775029e72c98fa67cd
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: ea4f3a20b3b90e64c065dd1a43047f01
kdelibs-devel-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 8c99f2100c9f3e5b03efff7165eff15c
 
Red Hat Enterprise Linux WS (v. 2.1)

IA-32:
arts-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 4d38bae519a161f1452bb554fb04ba81
ftp://updates.redhat.com/rhn/repository/NULL/kdebase/2.2.2-15/i386/kdebase-2.2.2-15.i386.rpm
Missing file
    MD5: 030a200855eb2be8bdc42800eeb06cef
ftp://updates.redhat.com/rhn/repository/NULL/kdebase-devel/2.2.2-15/i386/kdebase-devel-2.2.2-15.i386.rpm
Missing file
    MD5: 774d4f3c8b056b807279149410432482
kdelibs-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: bb8d504cb0c377299863c4b5a49fdeab
kdelibs-devel-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 5cdcc1ff323a76d713de8b602a8681e5
kdelibs-sound-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: 134afda3f20237a143a48b05efa19ce3
kdelibs-sound-devel-2.2.2-15.i386.rpm
File outdated by:  RHSA-2006:0720
    MD5: f4be4258a190a5dcf32c4c9cd338d9f9
 
Red Hat Enterprise Linux WS (v. 3)

IA-32:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-devel-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: a66570d58774ae59253985e9089f7074
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-devel-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 65ff2276ebd06a84363734aac1e819c2
 
IA-64:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-3.1.3-5.8.ia64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 3fff6529152bac165097691689afd5ae
kdebase-devel-3.1.3-5.8.ia64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 9e9245aceb7cb8d4422f91798ee47fcf
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-3.1.3-6.9.ia64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 3ff097e232c2c1ecd0a8684c8b526581
kdelibs-devel-3.1.3-6.9.ia64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 155776d1b23d3c1c881f805416ecc9fa
 
x86_64:
kdebase-3.1.3-5.8.i386.rpm
File outdated by:  RHSA-2007:0494
    MD5: 559c33d7383e7c81f2642f02c5aed26a
kdebase-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: 85c1ebcce8e37502e4c57ac5666bd5b6
kdebase-devel-3.1.3-5.8.x86_64.rpm
File outdated by:  RHSA-2007:0494
    MD5: cc159d0af68f93775029e72c98fa67cd
kdelibs-3.1.3-6.9.i386.rpm
File outdated by:  RHSA-2009:1128
    MD5: 1b9bf6cfbedde310068e7b47ec43dab0
kdelibs-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: ea4f3a20b3b90e64c065dd1a43047f01
kdelibs-devel-3.1.3-6.9.x86_64.rpm
File outdated by:  RHSA-2009:1128
    MD5: 8c99f2100c9f3e5b03efff7165eff15c
 
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

IA-64:
arts-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: 29b839c2620301ae2abfc6f26511e64e
ftp://updates.redhat.com/rhn/repository/NULL/kdebase/2.2.2-15/ia64/kdebase-2.2.2-15.ia64.rpm
Missing file
    MD5: aceb3a74103fd439be563eb1c5346890
ftp://updates.redhat.com/rhn/repository/NULL/kdebase-devel/2.2.2-15/ia64/kdebase-devel-2.2.2-15.ia64.rpm
Missing file
    MD5: 8b5de25703a71498f6ce9c316a7be391
kdelibs-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: ebd5bc9dd5419cf9dc00e8c663e0b722
kdelibs-devel-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: 6788128e0c457af8c7531f4ad4cf0620
kdelibs-sound-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: 0eced9a280854ff5a56cf9248778aa91
kdelibs-sound-devel-2.2.2-15.ia64.rpm
File outdated by:  RHSA-2006:0720
    MD5: c30d0494f359483f5ea45c216a75fb83
 

Bugs fixed (see bugzilla for more information)

139265 - KDE+Cadence bug
142393 - CAN-2004-1158 Frame injection vulnerability.
145381 - CAN-2005-0078 password bypass in kde screensaver
146760 - CAN-2004-1165 kioslave command injection


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/