Executive Summary
| Summary | |
|---|---|
| Title | kdelibs security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2009:1128 | First vendor Publication | 2009-06-25 |
| Vendor | RedHat | Last vendor Modification | 2009-06-25 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9.3 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated kdelibs packages that fix one security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Description: The kdelibs packages provide libraries for the K Desktop Environment (KDE). A flaw was found in the way the KDE CSS parser handled content for the CSS "style" attribute. A remote attacker could create a specially-crafted CSS equipped HTML page, which once visited by an unsuspecting user, could cause a denial of service (Konqueror crash) or, potentially, execute arbitrary code with the privileges of the user running Konqueror. (CVE-2009-1698) Users should upgrade to these updated packages, which contain a backported patch to correct this issue. The desktop must be restarted (log out, then log back in) for this update to take effect. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 506469 - CVE-2009-1698 kdelibs: KHTML CSS parser - incorrect handling CSS "style" attribute content (DoS, ACE) |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2009-1128.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13862 | |||
| Oval ID: | oval:org.mitre.oval:def:13862 | ||
| Title: | USN-822-1 -- kde4libs, kdelibs vulnerabilities | ||
| Description: | It was discovered that KDE-Libs did not properly handle certain malformed SVG images. If a user were tricked into opening a specially crafted SVG image, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 9.04. It was discovered that the KDE JavaScript garbage collector did not properly handle memory allocation failures. If a user were tricked into viewing a malicious website, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that KDE-Libs did not properly handle HTML content in the head element. If a user were tricked into viewing a malicious website, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that KDE-Libs did not properly handle the Cascading Style Sheets attr function call. If a user were tricked into viewing a malicious website, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-822-1 CVE-2009-0945 CVE-2009-1687 CVE-2009-1690 CVE-2009-1698 | Version: | 5 |
| Platform(s): | Ubuntu 8.10 Ubuntu 8.04 Ubuntu 9.04 | Product(s): | kde4libs kdelibs |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22057 | |||
| Oval ID: | oval:org.mitre.oval:def:22057 | ||
| Title: | ELSA-2009:1127: kdelibs security update (Critical) | ||
| Description: | WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2009:1127-01 CVE-2009-1687 CVE-2009-1690 CVE-2009-1698 | Version: | 17 |
| Platform(s): | Oracle Linux 5 | Product(s): | kdelibs |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:29301 | |||
| Oval ID: | oval:org.mitre.oval:def:29301 | ||
| Title: | RHSA-2009:1127 -- kdelibs security update (Critical) | ||
| Description: | Updated kdelibs packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The kdelibs packages provide libraries for the K Desktop Environment (KDE). | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2009:1127 CESA-2009:1127-CentOS 5 CVE-2009-1687 CVE-2009-1690 CVE-2009-1698 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 CentOS Linux 5 | Product(s): | kdelibs |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9484 | |||
| Oval ID: | oval:org.mitre.oval:def:9484 | ||
| Title: | WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. | ||
| Description: | WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not initialize a pointer during handling of a Cascading Style Sheets (CSS) attr function call with a large numerical argument, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-1698 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for kdelibs CESA-2009:1128 centos3 i386 File : nvt/gb_CESA-2009_1128_kdelibs_centos3_i386.nasl |
| 2011-08-09 | Name : CentOS Update for kdelibs CESA-2009:1127 centos5 i386 File : nvt/gb_CESA-2009_1127_kdelibs_centos5_i386.nasl |
| 2010-05-28 | Name : Fedora Update for kdelibs FEDORA-2010-8547 File : nvt/gb_fedora_2010_8547_kdelibs_fc11.nasl |
| 2010-04-19 | Name : Fedora Update for kdelibs FEDORA-2010-6077 File : nvt/gb_fedora_2010_6077_kdelibs_fc11.nasl |
| 2010-01-29 | Name : Mandriva Update for kdelibs4 MDVSA-2010:027 (kdelibs4) File : nvt/gb_mandriva_MDVSA_2010_027.nasl |
| 2009-12-14 | Name : Mandriva Security Advisory MDVSA-2009:330 (kdelibs) File : nvt/mdksa_2009_330.nasl |
| 2009-11-11 | Name : Ubuntu USN-857-1 (qt4-x11) File : nvt/ubuntu_857_1.nasl |
| 2009-09-28 | Name : Ubuntu USN-836-1 (webkit) File : nvt/ubuntu_836_1.nasl |
| 2009-09-15 | Name : Fedora Core 11 FEDORA-2009-9391 (kdelibs3) File : nvt/fcore_2009_9391.nasl |
| 2009-09-15 | Name : Fedora Core 10 FEDORA-2009-9400 (kdelibs3) File : nvt/fcore_2009_9400.nasl |
| 2009-09-02 | Name : Debian Security Advisory DSA 1868-1 (kde4libs) File : nvt/deb_1868_1.nasl |
| 2009-09-02 | Name : Debian Security Advisory DSA 1867-1 (kdelibs) File : nvt/deb_1867_1.nasl |
| 2009-09-02 | Name : Ubuntu USN-822-1 (kdelibs) File : nvt/ubuntu_822_1.nasl |
| 2009-07-29 | Name : Fedora Core 10 FEDORA-2009-8049 (kdelibs) File : nvt/fcore_2009_8049.nasl |
| 2009-07-29 | Name : Fedora Core 11 FEDORA-2009-8046 (kdelibs3) File : nvt/fcore_2009_8046.nasl |
| 2009-07-29 | Name : Fedora Core 11 FEDORA-2009-8039 (kdelibs) File : nvt/fcore_2009_8039.nasl |
| 2009-07-29 | Name : Fedora Core 10 FEDORA-2009-8020 (kdelibs3) File : nvt/fcore_2009_8020.nasl |
| 2009-06-30 | Name : RedHat Security Advisory RHSA-2009:1128 File : nvt/RHSA_2009_1128.nasl |
| 2009-06-30 | Name : CentOS Security Advisory CESA-2009:1127 (kdelibs) File : nvt/ovcesa2009_1127.nasl |
| 2009-06-30 | Name : CentOS Security Advisory CESA-2009:1128 (kdelibs) File : nvt/ovcesa2009_1128.nasl |
| 2009-06-30 | Name : RedHat Security Advisory RHSA-2009:1127 File : nvt/RHSA_2009_1127.nasl |
| 2009-06-16 | Name : Apple Safari Multiple Vulnerabilities June-09 (Win) - II File : nvt/gb_apple_safari_mult_vuln_jun09_2.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 55417 | KDE Konqueror WebKit CSS attr Function Uninitialized Pointer Issue Arbitrary ... |
| 55006 | Apple iPhone / Safari WebKit CSS attr() Function Uninitialized Pointer Issue ... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_libwebkit-110104.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1127.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1128.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090625_kdelibs_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090625_kdelibs_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_libwebkit-110111.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_kdelibs3-101104.nasl - Type : ACT_GATHER_INFO |
| 2010-07-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-027.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1950.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1867.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1988.nasl - Type : ACT_GATHER_INFO |
| 2010-02-24 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1868.nasl - Type : ACT_GATHER_INFO |
| 2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1127.nasl - Type : ACT_GATHER_INFO |
| 2009-12-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-346.nasl - Type : ACT_GATHER_INFO |
| 2009-11-11 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-857-1.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-836-1.nasl - Type : ACT_GATHER_INFO |
| 2009-08-25 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-822-1.nasl - Type : ACT_GATHER_INFO |
| 2009-07-29 | Name : The remote Fedora host is missing a security update. File : fedora_2009-8049.nasl - Type : ACT_GATHER_INFO |
| 2009-07-29 | Name : The remote Fedora host is missing a security update. File : fedora_2009-8046.nasl - Type : ACT_GATHER_INFO |
| 2009-07-29 | Name : The remote Fedora host is missing a security update. File : fedora_2009-8039.nasl - Type : ACT_GATHER_INFO |
| 2009-07-29 | Name : The remote Fedora host is missing a security update. File : fedora_2009-8020.nasl - Type : ACT_GATHER_INFO |
| 2009-06-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1127.nasl - Type : ACT_GATHER_INFO |
| 2009-06-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1128.nasl - Type : ACT_GATHER_INFO |
| 2009-06-26 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1128.nasl - Type : ACT_GATHER_INFO |
| 2009-06-09 | Name : The remote host contains a web browser that is affected by several vulnerabil... File : macosx_Safari4_0.nasl - Type : ACT_GATHER_INFO |
| 2009-06-09 | Name : The remote host contains a web browser that is affected by several vulnerabil... File : safari_4.0.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:52:38 |
|
