A security flaw was found in the way PasteMacroExpander of paste applet of kdeplasma-addons, a suite of additional plasmoids for KDE desktop environment, performed password generation / derivation for user provided string. An attacker could use this flaw to obtain plaintext form of such a password (possibly leading to their subsequent ability for unauthorized access to a service / resource, intended to be protected by such a password).

References: [1] http://www.openwall.com/lists/oss-security/2013/05/28/5 [2] https://bugzilla.novell.com/showbug.cgi?id=822595

Michael Samuel (mik) reports: KRandom::random() should not be considered a secure PRNG due to having a limited space of random values (32bits).

Reference: http://openwall.com/lists/oss-security/2013/06/26/1 http://openwall.com/lists/oss-security/2013/06/26/2