RHSA-2011:1364: Moderate: kdelibs security and enhancement update
The kdelibs packages provide libraries for the K Desktop Environment (KDE).An input sanitization flaw was found in the KSSL (KDE SSL Wrapper) API. Anattacker could supply a specially-crafted SSL certificate (for example, viaa web page) to an application using KSSL, such as the Konqueror webbrowser, causing misleading information to be presented to the user,possibly tricking them into accepting the certificate as valid.(CVE-2011-3365)This update also adds the following enhancement: kdelibs provided its own set of trusted Certificate Authority (CA) certificates. This update makes kdelibs use the system set from theca-certificates package, instead of its own copy. (BZ#743951)Users should upgrade to these updated packages, which contain backportedpatches to correct this issue and add this enhancement. The desktop must berestarted (log out, then log back in) for this update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:1364?
The severity of RHSA-2011:1364 is classified as moderate.
What is the vulnerability in RHSA-2011:1364?
RHSA-2011:1364 contains an input sanitization flaw in the KSSL API that can be exploited with specially-crafted SSL certificates.
How do I fix RHSA-2011:1364?
To fix RHSA-2011:1364, upgrade the kdelibs packages to version 4.3.4-11.el6_1.4.
Which packages are affected by RHSA-2011:1364?
The affected packages in RHSA-2011:1364 include kdelibs, kdelibs-apidocs, kdelibs-common, and their respective debuginfo and devel packages.
Is there a workaround for RHSA-2011:1364?
There are no known workarounds for the vulnerability in RHSA-2011:1364; upgrading is recommended.