Stay Secure with the Latest Linux Advisories

security advisoryfedoracritical

Fedora 7: 2007-1699 Critical Update For Kdelibs URL Spoofing Issues

This update primarily addresses problems with URL spoofing and consolekit/session permissions.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2007-1699 2007-08-20 09:03:20.204438 --------------------------------------------------------------------------------Name : kdelibs Product : Fedora 7 Version : 3.5.7 Release : 20.fc7 Summary : K Desktop Environment - Libraries Description : Libraries for the K Desktop Environment: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). --------------------------------------------------------------------------------Update Information: This update primarily addresses problems with URL spoofing and consolekit/session permissions. --------------------------------------------------------------------------------ChangeLog: * Wed Aug 15 2007 Rex Dieter 6:3.5.7-20 - CVE-2007-3820, CVE-2007-4224, CVE-2007-4225 - clarify licensing * Tue Aug 14 2007 Rex Dieter 6:3.5.7-19 - ConsoleKit-related patch (#244065) * Sun Aug 12 2007 Florian La Roche 6:3.5.7-18 - fix apidocs subpackage requires * Mon Aug 6 2007 Than Ngo - 6:3.5.7-17 - cleanup * Fri Aug 3 2007 Rex Dieter - 6:3.5.7-16 - undo kdelibs3 rename (for now, anyway) - move to -devel: checkXML, kconfig_compiler, (make)kdewidgets, ksgmltools2, ksvgtopng, kunittestmodrunner - set KDE_IS_PRELINKED unconditionally (#244065) - License: LGPLv2+ * Fri Jul 20 2007 Rex Dieter - 6:3.5.7-15 - Obsoletes/Provides: kdelibs-apidocs (kdelibs3) * Fri Jul 20 2007 Rex Dieter - 6:3.5.7-14 - toggle kdelibs3 (f8+) * Wed Jul 18 2007 Rex Dieter - 6:3.5.7-13 - build fails against cups-1.3 (#248717) - incorporate kdelibs3 bits (not enabled... yet) * Wed Jul 18 2007 Rex Dieter - 6:3.5.7-10 - +Requires:kde-filesystem * Mon Jul 9 2007 Rex Dieter - 6:3.5.7-9 - omit ICEauthority patch (kde#147454, rh#243560, rh#247455) * Wed Jun 20 2007 Rex Dieter - 6:3.5.7-8 - rework previously botched openssl patch * Wed Jun 20 2007 Rex Dieter - 6:3.5.7-7 - -devel: Provides: kdelibs3-devel = ... - openssl patch update (portability) - drop deprecated ssl-krb5 patch * Sat Jun 16 2007 Rex Dieter - 6:3.5.7-6 - Provides: kdelibs3 = %version-%release * Sat Jun 16 2007 Rex Dieter - 6:3.5.7-5 - -devel: +Requires: libutempter-devel * Fri Jun 15 2007 Rex Dieter - 6:3.5.7-4 - omit lib_loader patch (doesn't apply cleanly) * Fri Jun 15 2007 Rex Dieter - 6:3.5.7-3 - include experimental libtool patches * Mon Jun 11 2007 Rex Dieter - 6:3.5.7-2 - kdesu: sudo support (kde bug #20914), Requires(hint): sudo * Wed Jun 6 2007 Than Ngo - 6:3.5.7-0.1.fc7 - 3.5.7 * Thu May 24 2007 Than Ngo 6:3.5.6-10.fc7 - don't change permission .ICEauthority by sudo KDE programs - apply patch to fix locale issue - apply upstream patch to fix kde#146105 --------------------------------------------------------------------------------References: [ 1 ] Bug #248717 https://bugzilla.redhat.com/show_bug.cgi?id=248717 [ 2 ] Bug #244065 https://bugzilla.redhat.com/show_bug.cgi?id=244065 [ 3 ] CVE-2007-3820 [ 4 ] CVE-2007-4224 [ 5 ] CVE-2007-4225 --------------------------------------------------------------------------------Updated packages: da99b0c84992e7ddba7402d0b664b86644fc740f kdelibs-3.5.7-20.fc7.ppc64.rpm 2bbe1e5a48f17b17042e4a005df186d0c5200fb9 kdelibs-devel-3.5.7-20.fc7.ppc64.rpm 60145619267321a5b5a07a0ca75fc218712682af kdelibs-debuginfo-3.5.7-20.fc7.ppc64.rpm fea397416fcddf526b3f298ba80e617c45e4c910 kdelibs-apidocs-3.5.7-20.fc7.ppc64.rpm 53578888d43d22a5fd07eff396fed9a3b09c22d8 kdelibs-apidocs-3.5.7-20.fc7.i386.rpm 459ef9591b3db30e753de1ac80e4770624ec11f3 kdelibs-devel-3.5.7-20.fc7.i386.rpm 89476ee168de0f491a26315d4ccec61d5735db95kdelibs-debuginfo-3.5.7-20.fc7.i386.rpm cedf5461e69ed9351754470b40db02cedea9808e kdelibs-3.5.7-20.fc7.i386.rpm 87db2cae70d5f174b94ccaefd4cb1063f30955c7 kdelibs-3.5.7-20.fc7.x86_64.rpm f6dcc07324d042b4da805ccd4fe9f5e8f84019bf kdelibs-debuginfo-3.5.7-20.fc7.x86_64.rpm 69d46644da6f6095d780aa4b8d26844b4d26a387 kdelibs-apidocs-3.5.7-20.fc7.x86_64.rpm 4a3e81fa59e126243e5534bdd4165dc3fd8c6a3f kdelibs-devel-3.5.7-20.fc7.x86_64.rpm d86e0364ccdcbf81665fb7eca25fe25e6f0940fc kdelibs-3.5.7-20.fc7.ppc.rpm a9d5456dd26c8189bdd495213520e155f2c5cc9b kdelibs-apidocs-3.5.7-20.fc7.ppc.rpm 9bf77515e5a19079a9ba486468f8e00967ef2de8 kdelibs-devel-3.5.7-20.fc7.ppc.rpm 87bfc77c4ba5c39e012478ff70eaf03790d58abb kdelibs-debuginfo-3.5.7-20.fc7.ppc.rpm b5d7faa3f87ad00efa2dc6fccfb29d99e5dc14da kdelibs-3.5.7-20.fc7.src.rpm This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at . --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Update for Fedora focusing on HTTP redirect vulnerabilities and ConsoleKit access control gaps within kdelibs in the 3.5.7 release.. KDE Libraries Update,Fedora 7 Security,Kdelibs Permissions Fix,URL Spoofing Mitigation. . Severity: Critical. LinuxSecurity.com Team

Aug 27, 2007 •Critical Fedora