MDKSA-2005:045 - Updated kdelibs packages fix vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandrakelinux Security Update Advisory
_______________________________________________________________________
Package name: kdelibs
Advisory ID: MDKSA-2005:045
Date: February 17th, 2005
Affected versions: 10.0, 10.1, Corporate 3.0
______________________________________________________________________
Problem Description:
A bug in the way kioslave handles URL-encoded newline (%0a)
characters before the FTP command was discovered. Because of this, it
is possible that a specially crafted URL could be used to execute any
ftp command on a remote server, or even send unsolicited email.
As well, Davide Madrisan discovered that dcopidlng created temporary
files in an insecure manner.
The updated packages are patched to deal with these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1165
http://www.kde.org/info/security/advisory-20050101-1.txt
http://bugs.kde.org/show_bug.cgi?id=97608
______________________________________________________________________
Updated Packages:
Mandrakelinux 10.0:
36c26678038288bba80c3d72c9a1e20a
10.0/RPMS/kdelibs-common-3.2-36.10.100mdk.i586.rpm
3db366da3e09c4237e2a88732faca7a7
10.0/RPMS/libkdecore4-3.2-36.10.100mdk.i586.rpm
38c354234f316a456b9ff82c9535546e
10.0/RPMS/libkdecore4-devel-3.2-36.10.100mdk.i586.rpm
6912a08ee5359a4fdb48cac88b1a038b 10.0/SRPMS/kdelibs-3.2-36.10.100mdk.src.rpm
Mandrakelinux 10.0/AMD64:
dd9a0f3b2adcb7b59831e8f0edd73cce
amd64/10.0/RPMS/kdelibs-common-3.2-36.10.100mdk.amd64.rpm
7a20989e14ff56ac7dbabca376bfba12
amd64/10.0/RPMS/lib64kdecore4-3.2-36.10.100mdk.amd64.rpm
071d26aa2f356d2dcc2bff274425531b
amd64/10.0/RPMS/lib64kdecore4-devel-3.2-36.10.100mdk.amd64.rpm
6912a08ee5359a4fdb48cac88b1a038b
amd64/10.0/SRPMS/kdelibs-3.2-36.10.100mdk.src.rpm
Mandrakelinux 10.1:
0cfe09de4cb942b4368cd1de240b17fa
10.1/RPMS/kdelibs-common-3.2.3-103.1.101mdk.i586.rpm
d8022d4320136b4112c23341c1312af5
10.1/RPMS/libkdecore4-3.2.3-103.1.101mdk.i586.rpm
41a707aab07bf9638c03103d40bca306
10.1/RPMS/libkdecore4-devel-3.2.3-103.1.101mdk.i586.rpm
8a24af1c667e03470cf4528dbd86a164 10.1/SRPMS/kdelibs-3.2.3-103.1.101mdk.src.rpm
Mandrakelinux 10.1/X86_64:
0ddace363e075b7715ddf481e530eaa7
x86_64/10.1/RPMS/kdelibs-common-3.2.3-103.1.101mdk.x86_64.rpm
b22c35e586b9a26c85998b77904a7340
x86_64/10.1/RPMS/lib64kdecore4-3.2.3-103.1.101mdk.x86_64.rpm
3550dbe6d2c956442ecbda70fa71d9dd
x86_64/10.1/RPMS/lib64kdecore4-devel-3.2.3-103.1.101mdk.x86_64.rpm
d8022d4320136b4112c23341c1312af5
x86_64/10.1/RPMS/libkdecore4-3.2.3-103.1.101mdk.i586.rpm
8a24af1c667e03470cf4528dbd86a164
x86_64/10.1/SRPMS/kdelibs-3.2.3-103.1.101mdk.src.rpm
Corporate 3.0:
d93acd6d0050a6a5b0abddb91a791db5
corporate/3.0/RPMS/kdelibs-common-3.2-36.10.C30mdk.i586.rpm
6e3073f7f0ac52b6fcf38d43261cb7c3
corporate/3.0/RPMS/libkdecore4-3.2-36.10.C30mdk.i586.rpm
c753a66a47496ee4f765384afafa88d0
corporate/3.0/RPMS/libkdecore4-devel-3.2-36.10.C30mdk.i586.rpm
f057bf8b85687559e57527247cdc1de7
corporate/3.0/SRPMS/kdelibs-3.2-36.10.C30mdk.src.rpm
Corporate 3.0/X86_64:
04adc6e0b68e461c0b8bf5c3d07e4cbc
x86_64/corporate/3.0/RPMS/kdelibs-common-3.2-36.10.C30mdk.x86_64.rpm
71202f8a27e9fdb2846cd14c339b87fa
x86_64/corporate/3.0/RPMS/lib64kdecore4-3.2-36.10.C30mdk.x86_64.rpm
01d20ae725a9127ca492b9f447f189c0
x86_64/corporate/3.0/RPMS/lib64kdecore4-devel-3.2-36.10.C30mdk.x86_64.rpm
f057bf8b85687559e57527247cdc1de7
x86_64/corporate/3.0/SRPMS/kdelibs-3.2-36.10.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFCFVuMmqjQ0CJFipgRAj2uAKDypzAdIDIK3cDnfGlN1QZJrnyWTgCeLjwZ
WyFMDq1yWBQ1kRWTFdLApo8=
=oTms
-----END PGP SIGNATURE-----