Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
Debian Security Advisory DSA 155-1 (kdelibs)
Information
Severity
Severity
Family
Family
CVSSv2 Base
CVSSv2 Base
CVSSv2 Vector
CVSSv2 Vector
Solution Type
Solution Type
Created
Created
Modified
Modified
Summary
The remote host is missing an update to kdelibs announced via advisory DSA 155-1.
Insight
Insight
Due to a security engineering oversight, the SSL library from KDE, which Konqueror uses, doesn't check whether an intermediate certificate for a connection is signed by the certificate authority as safe for the purpose, but accepts it when it is signed. This makes it possible for anyone with a valid VeriSign SSL site certificate to forge any other VeriSign SSL site certificate, and abuse Konqueror users. A local root exploit using artsd has been discovered which exploited an insecure use of a format string. The exploit wasn't working on a Debian system since artsd wasn't running setuid root. Neither artsd nor artswrapper need to be setuid root anymore since current computer systems are fast enuogh to handle the audio data in time. These problems have been fixed in version 2.2.2-13.woody.2 for the current stable stable distribution (woody). The old stable distribution (potato) is not affected, since it doesn't contain KDE packages. The unstable distribution (sid) is not yet fixed, but new packages are expected in the future, the fixed version will be version 2.2.2-14 or higher. We recommend that you upgrade your kdelibs and libarts packages and
Solution
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20155-1