--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2009-8020
2009-07-27 21:06:00
--------------------------------------------------------------------------------

Name        : kdelibs3
Product     : Fedora 10
Version     : 3.5.10
Release     : 13.fc10
URL         : https://kde.org/
Summary     : K Desktop Environment 3 - Libraries
Description :
Libraries for the K Desktop Environment 3:
KDE Libraries included: kdecore (KDE core library), kdeui (user interface),
kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking),
kspell (spelling checker), jscript (javascript), kab (addressbook),
kimgio (image manipulation).

--------------------------------------------------------------------------------
Update Information:

This update fixes several security issues in the KDE 3 compatibility version of
KHTML (CVE-2009-1725, CVE-2009-1690, CVE-2009-1687, CVE-2009-1698,
CVE-2009-2537) which may lead to a denial of service or potentially even
arbitrary code execution.    In addition, the package was fixed to build with
the latest version of automake, and the following fixes and improvements were
merged from the Fedora 11 package:  * slight speedup to /etc/profile.d/kde.sh,
* fixed unowned directories,  * fixed harmless (as the file contents match) file
conflicts with KDE 4.2.x,  * fixed build with GCC 4.4 (but this package is built
with Fedora 10's GCC 4.3.2),  * moved Qt Designer plugins to the runtime package
as they can be needed at runtime (e.g. by PyKDE programs),  * kdelibs3-apidocs
is now a noarch subpackage.
--------------------------------------------------------------------------------
ChangeLog:

* Sun Jul 26 2009 Kevin Kofler  - 3.5.10-13
- fix CVE-2009-2537 - select length DoS
- fix CVE-2009-1725 - crash, possible ACE in numeric character references
- fix CVE-2009-1690 - crash, possible ACE in KHTML ( use-after-free)
- fix CVE-2009-1687 - possible ACE in KJS (FIXME: still crashes?)
- fix CVE-2009-1698 - crash, possible ACE in CSS style attribute handling
* Fri Jul 24 2009 Fedora Release Engineering  - 3.5.10-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
* Sat Jul 18 2009 Rex Dieter  - 3.5.10-12 
- FTBFS kdelibs3-3.5.10-11.fc11 (#511571)
- -devel: Requires: %{name}%_isa ...
* Sun Apr 19 2009 Rex Dieter  - 3.5.10-11
- update openssl patch (for 0.9.8k)
* Thu Apr 16 2009 Rex Dieter  - 3.5.10-10
- move designer plugins to runtime (#487622)
- make -apidocs noarch
* Mon Mar  2 2009 Than Ngo  - 3.5.10-9
- enable -apidocs
* Fri Feb 27 2009 Rex Dieter  - 3.5.10-8
- disable -apidocs (f11+, #487719)
- cleanup unused kdeui_symlink hack baggage
* Wed Feb 25 2009 Than Ngo  - 3.5.10-7
- fix files conflicts with 4.2.x
- fix build issue with gcc-4.4
* Wed Feb 25 2009 Fedora Release Engineering  - 3.5.10-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
* Sat Jan 31 2009 Rex Dieter  - 6:3.5.10-5
- unowned dirs (#483318)
* Sat Jan 10 2009 Ville Skyttä  - 6:3.5.10-4
- Slight speedup to profile.d/kde.sh (#465370).
* Mon Dec 15 2008 Kevin Kofler  3.5.10-3
- update the KatePart latex.xml syntax definition to the version from Kile 2.0.3
* Thu Dec  4 2008 Rex Dieter  3.5.10-2
- omit libkscreensaver (F9+)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #513813 - CVE-2009-1725: KHTML: improper handling of numeric character references (ACE, DoS)
        https://bugzilla.redhat.com/show_bug.cgi?id=513813
  [ 2 ] Bug #505571 - CVE-2009-1690 kdelibs: KHTML Incorrect handling  element content once the  element was removed (DoS, ACE)
        https://bugzilla.redhat.com/show_bug.cgi?id=505571
  [ 3 ] Bug #506453 - CVE-2009-1687 kdelibs: Integer overflow in KJS JavaScript garbage collector
        https://bugzilla.redhat.com/show_bug.cgi?id=506453
  [ 4 ] Bug #506469 - CVE-2009-1698 kdelibs: KHTML CSS parser - incorrect handling CSS "style" attribute content (DoS, ACE)
        https://bugzilla.redhat.com/show_bug.cgi?id=506469
  [ 5 ] Bug #512911 - CVE-2009-2537 Konqueror: DoS via large length property of a Select object
        https://bugzilla.redhat.com/show_bug.cgi?id=512911
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update kdelibs3' at the command line.
For more information, refer to "Managing Software with yum",
available at .

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
--------------------------------------------------------------------------------

_______________________________________________
Fedora-package-announce mailing list
Fedora-package-announce@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-package-announce