--===============4105843062141781666==
Content-Type: multipart/signed; micalg="pgp-sha512";
 protocol="application/pgp-signature"; boundary="=-4A41tdX6gKbdslUouyt+"


--=-4A41tdX6gKbdslUouyt+
Content-Type: text/plain; charset="UTF-8
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-1110-1
April 14, 2011

kde4libs vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 9.10

Summary:

An attacker could send crafted input to Konqueror to view sensitive
information.

Software Description:
- kde4libs: KDE 4 core applications

Details:

It was discovered that KDE KSSL did not properly verify X.509 certificates
when the certificate was issued for an IP address. An attacker could
exploit this to perform a man in the middle attack to view sensitive
information or alter encrypted communications. (CVE-2011-1094)

Tim Brown discovered that KDE KHTML did not properly escape URLs from
externally generated error pages. An attacker could expoit this to conduct
cross-site scripting attacks. With cross-site scripting vulnerabilities, if
a user were tricked into viewing server output during a crafted server
request, a remote attacker could exploit this to modify the contents, or
steal confidential data (such as passwords), within the same domain.
(CVE-2011-1168)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
  libkhtml5                       4:4.5.1-0ubuntu8.1
  libkio5                         4:4.5.1-0ubuntu8.1

Ubuntu 10.04 LTS:
  kdelibs5                        4:4.4.5-0ubuntu1.1

Ubuntu 9.10:
  kdelibs5                        4:4.3.2-0ubuntu7.3

After a standard system update you need to restart any applications that
use KSSL or KHTML, such as Konqueror, to make all the necessary changes.

References:
  CVE-2011-1094, CVE-2011-1168

Package Information:
  https://launchpad.net/ubuntu/+source/kde4libs/4:4.5.1-0ubuntu8.1
  https://launchpad.net/ubuntu/+source/kde4libs/4:4.4.5-0ubuntu1.1
  https://launchpad.net/ubuntu/+source/kde4libs/4:4.3.2-0ubuntu7.3



--ÔA41tdX6gKbdslUouyt+
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAABCgAGBQJNpzLsAAoJEFHb3FjMVZVz2T8P/AyjzVDeuVLMVKBt8XlVs07n
Im5WHwUOJBU2tZRRI8bdTwOKQnc3eBYeFkbsmBiO1TZHZn2j/Y3NaoCjBexnyi1e
zahOS4ZPCIHHDZLZjyfG7Roatdffm86WoT9udXO50QWxq7A+P4Vybn4mMGCChsNw
O2b0QkvxftH6kfvr/kwUbf0fqItVH9sP6QIMenEpolZcNC3W2N8h8AYeiQYp2PaN
TDsJfkBQnEba1IlylpBquwZdQevJv7QWa6Mt5HLSI44Y8qS7vVRvhfYE0/bWe5L6
2UEzUhi51sy0NBu23ukL+mukGZF/c96zmo0CYOa0Q8faWwFZiN6J5L36MmEGWSNX
GITrqeC0zIrE6k+la14WMgWh4Prnvm89gvqOvnuFF6Fn1FAbEjR3bfhL8J5lrLVy
wGlz45gfzhPbYRycYCi8gyK51Hvd3dzG0rIo8OBGcWaIPayilV787RkTtZSHM24Q
PjmoMAhCKQu7piGAwGwKtN/+8RCHycyamQs4XmyUOPTJlkYq5vPlA3kYQflGw1wQ
nV/EDwwA6iKtVZBlRQ9ta2EfOSKlL0fUKB4Xi4RVXR1unYfYKTvkBBL0cA21bLAh
3TZT8uSTRLKdjdULbAz8BQfbzqLFhmAVMAcI/JWdpiINz/+62V0Zhq+t5CE9F7P+
GQTxsUxA2x0TVMWF7PHe
=74wb
-----END PGP SIGNATURE-----

--=-4A41tdX6gKbdslUouyt+--



--===============4105843062141781666==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============4105843062141781666==--