A path traversal flaw was found in the way Ark, the tool for managing various archive formats within the KDE environment, processed certain Zip archives. A remote attacker could provide a specially-crafted Zip archive, which once opened in the Ark GUI frontend would lead to arbitrary file being opened or, potentially, if the local victim provided correct user credentials could allow that file to be removed.
References: [1] http://www.openwall.com/lists/oss-security/2011/07/25/9 [2] https://bugzilla.novell.com/showbug.cgi?id=708268
An input validation failure was discovered in KSSL (CVE-2011-3365) and Rekonq (CVE-2011-3366) in KDE SC 4.6.0 up to and including KDE SC 4.7.1, however upstream indicates that ealier versions of KDE SC may also be affected. The upstream advisory [1] details are noted below:
The default rendering type for a QLabel is QLabel::AutoText, which uses heuristics to determine whether to render the given content as plain text or rich text.
When displaying a security dialog with a certificate, KSSL does not properly force its QLabels to use QLabel::PlainText. As a result, if given a certificate containing rich text in its fields, it will render the rich text.
Specifically, a certificate containing a common name (CN) that has a table element will cause the second line of the table to be displayed. This can allow spoofing of the certificate's common name.
The vulnerability and technical information about the exploit were provided by Tim Brown of Nth Dimension. We thank them for their responsible disclosure and cooperative handling of the matter.
Exploitation may trick the user into beliving a certificate is legitimate when in fact it is invalid, and simply displayed incorrectly.
This has been corrected via the following git [2] commits:
4.6 branch: 9ca2b26f 90607b28 4.7 branch: bd70d4e5 86622e4d frameworks: bd70d4e5 86622e4d
(Note: the second commit for each branch above is a fix for kiohttp that fixes a similar issue, but with only very minor security implications.)
And for Rekonq, the following commits correct it in git [3]:
85f454fa 526ce56f d1711fff
Finally, Qt has also received a patch to warn users about sanitizing their QLabel [4].
[1] http://www.kde.org/info/security/advisory-20111003-1.txt [2] http://quickgit.kde.org/?p=kdelibs.git&a=summary [3] http://quickgit.kde.org/?p=rekonq.git&a=summary [4] https://qt.gitorious.org/qt/qt/commit/31f7ecbdcdbafbac5bbfa693e4d060757244941b