DEC
13
2004

Security: Multiple KDE Security Advisories

Three security advisories have been issued by the
KDE Security Team over the last few days for three distinct vulnerabilities that have been found in KDE:

Plain Text Password Exposure
,

KFax libtiff Vulnerabilities
and a

Konqueror Window Injection Vulnerability
.

The most serious one is the libtiff vulnerability in KFax. Until recently KFax used to include a private copy of libtiff. As a result KFax has not been able to take advantage of

several recent security fixes in libtiff
. KFax in KDE 3.3.2 has been fixed so that it no longer requires a private copy of libtiff. Due to the complexity of this change there are no source patches for older versions available, we do expect vendors to provide fixed KFax packages for older KDE versions though.

The password exposure vulnerability primarily concerns passwords for SMB shares, as previously reported by
SEC Consult. The Konqueror window injection vulnerability addresses a problem
raised by Secunia and last week reported by Slashdot.

An overview of all the KDE security advisories can be found on
http://www.kde.org/info/security/.
{"cc_re__cc_re__cc_by_3_0": ["</a>\n</li>\n<li class=\"last\"><a href=\"https://sprints.kde.org/sprint/306\">KDE PIM Spring Sprint (in 63 days)</a>\n</li>\n</ul></div><div class=\"more-link\"><a href=\"/aggregator/sources/4\" title=\"View this feed&#039;s recent news.\">More</a></div>  </div>\n</div>\n  </div>\n\n            \n        </div>\n    </div>\n\n            <footer class=\"copyright align-center\">\n              <div class=\"region region-footer\">\n    <div id=\"block-block-2\" class=\"block block-block\">\n\n    \n  <div class=\"content\">\n    <p><a rel=\"nofollow\" href=\"http://creativecommons.org/licenses/by/3.0/\"></a>\u00a0 This work by KDE is licensed under a <a rel=\"nofollow\" href=\"http://creativecommons.org/licenses/by/3.0/\">Creative Commons Attribution 3.0 Unported License</a>.</p>\n  </div>\n</div>\n<div id=\"block-system-powered-by\" class=\"block block-system\">\n\n    \n  <div class=\"content\">\n    <span>Powered by <a href=\"https://www.drupal.org\">Drupal</a></span>  </div>\n</div>\n  </div>\n        </footer>\n    </div>\n        <script type=\"text/javascript\" src=\"https://dot.kde.org/sites/dot.kde.org/files/js/js_U", "/li>\n</ul></div><div class=\"more-link\"><a href=\"/aggregator/sources/4\" title=\"View this feed&#039;s recent news.\">More</a></div>  </div>\n</div>\n  </div>\n\n            \n        </div>\n    </div>\n\n            <footer class=\"copyright align-center\">\n              <div class=\"region region-footer\">\n    <div id=\"block-block-2\" class=\"block block-block\">\n\n    \n  <div class=\"content\">\n    <p><a rel=\"nofollow\" href=\"http://creativecommons.org/licenses/by/3.0/\"></a>\u00a0 This work by KDE is licensed under a <a rel=\"nofollow\" href=\"http://creativecommons.org/licenses/by/3.0/\">Creative Commons Attribution 3.0 Unported License</a>.</p>\n  </div>\n</div>\n<div id=\"block-system-powered-by\" class=\"block block-system\">\n\n    \n  <div class=\"content\">\n    <span>Powered by <a href=\"https://www.drupal.org\">Drupal</a></span>  </div>\n</div>\n  </div>\n        </footer>\n    </div>\n        <script type=\"text/javascript\" src=\"https://dot.kde.org/sites/dot.kde.org/files/js/js_UWQINlriydSoeSiGQxToOUdv493zEa7dpsXC1OtYlZU.js\"></script>\n<script type=\"text/javascript\">\n<!--//--><![CDATA[//><!-"], "copyright__copyright__copyright": ["exity of this change there are no source patches for older versions available, we do expect vendors to provide fixed KFax packages for older KDE versions though.\n\nThe password exposure vulnerability primarily concerns passwords for SMB shares, as previously reported by\nSEC Consult. The Konqueror window injection vulnerability addresses a problem\nraised by Secunia and last week reported by Slashdot.\n\nAn overview of all the KDE security advisories can be found on\nhttp://www.kde.org/info/security/."]}