Executive Summary

Informations
Name CVE-2011-3365 First vendor Publication 2011-11-29
Vendor Cve Last vendor Modification 2023-02-13

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3365

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17794
 
Oval ID: oval:org.mitre.oval:def:17794
Title: USN-1248-1 -- kde4libs vulnerability
Description: KDE-Libs could improperly display fraudulent security certificates.
Family: unix Class: patch
Reference(s): USN-1248-1
CVE-2011-3365
Version: 5
Platform(s): Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04
Product(s): kde4libs
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21776
 
Oval ID: oval:org.mitre.oval:def:21776
Title: RHSA-2011:1385: kdelibs and kdelibs3 security update (Moderate)
Description: The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Family: unix Class: patch
Reference(s): RHSA-2011:1385-01
CESA-2011:1385
CVE-2011-3365
Version: 4
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
Product(s): kdelibs
kdelibs3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23311
 
Oval ID: oval:org.mitre.oval:def:23311
Title: DEPRECATED: ELSA-2011:1385: kdelibs and kdelibs3 security update (Moderate)
Description: The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Family: unix Class: patch
Reference(s): ELSA-2011:1385-01
CVE-2011-3365
Version: 7
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): kdelibs
kdelibs3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23626
 
Oval ID: oval:org.mitre.oval:def:23626
Title: ELSA-2011:1385: kdelibs and kdelibs3 security update (Moderate)
Description: The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Family: unix Class: patch
Reference(s): ELSA-2011:1385-01
CVE-2011-3365
Version: 6
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): kdelibs
kdelibs3
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27107
 
Oval ID: oval:org.mitre.oval:def:27107
Title: RHSA-2011:1364 -- kdelibs security and enhancement update (Moderate)
Description: The kdelibs packages provide libraries for the K Desktop Environment (KDE). An input sanitization flaw was found in the KSSL (KDE SSL Wrapper) API. An attacker could supply a specially-crafted SSL certificate (for example, via a web page) to an application using KSSL, such as the Konqueror web browser, causing misleading information to be presented to the user, possibly tricking them into accepting the certificate as valid. (CVE-2011-3365) This update also adds the following enhancement: * kdelibs provided its own set of trusted Certificate Authority (CA) certificates. This update makes kdelibs use the system set from the ca-certificates package, instead of its own copy. (BZ#743951) Users should upgrade to these updated packages, which contain backported patches to correct this issue and add this enhancement. The desktop must be restarted (log out, then log back in) for this update to take effect.
Family: unix Class: patch
Reference(s): RHSA-2011:1364
CVE-2011-3365
Version: 3
Platform(s): Red Hat Enterprise Linux 6
Product(s): kdelibs
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27947
 
Oval ID: oval:org.mitre.oval:def:27947
Title: ELSA-2011-1364 -- kdelibs security and enhancement update (moderate)
Description: [6:4.3.4-11.4] - Resolves: bz#743951, use ca-certificates' ca-bundle.crt [6:4.3.4-11.3] - Resolves: bz#743515, CVE-2011-3365 - input validation failure
Family: unix Class: patch
Reference(s): ELSA-2011-1364
CVE-2011-3365
Version: 3
Platform(s): Oracle Linux 6
Product(s): kdelibs
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8

OpenVAS Exploits

Date Description
2012-07-30 Name : CentOS Update for kdelibs CESA-2011:1385 centos4 x86_64
File : nvt/gb_CESA-2011_1385_kdelibs_centos4_x86_64.nasl
2012-07-30 Name : CentOS Update for kdelibs CESA-2011:1385 centos5 x86_64
File : nvt/gb_CESA-2011_1385_kdelibs_centos5_x86_64.nasl
2012-07-09 Name : RedHat Update for kdelibs RHSA-2011:1364-01
File : nvt/gb_RHSA-2011_1364-01_kdelibs.nasl
2012-04-02 Name : Fedora Update for kgamma FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kgamma_fc16.nasl
2012-04-02 Name : Fedora Update for ksaneplugin FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_ksaneplugin_fc16.nasl
2012-04-02 Name : Fedora Update for kruler FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kruler_fc16.nasl
2012-04-02 Name : Fedora Update for konsole FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_konsole_fc16.nasl
2012-04-02 Name : Fedora Update for kmplot FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kmplot_fc16.nasl
2012-04-02 Name : Fedora Update for klettres FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_klettres_fc16.nasl
2012-04-02 Name : Fedora Update for kiten FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kiten_fc16.nasl
2012-04-02 Name : Fedora Update for khangman FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_khangman_fc16.nasl
2012-04-02 Name : Fedora Update for kgeography FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kgeography_fc16.nasl
2012-04-02 Name : Fedora Update for kwordquiz FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kwordquiz_fc16.nasl
2012-04-02 Name : Fedora Update for kdesdk FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdesdk_fc16.nasl
2012-04-02 Name : Fedora Update for kdeplasma-addons FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeplasma-addons_fc16.nasl
2012-04-02 Name : Fedora Update for kdepim-runtime FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdepim-runtime_fc16.nasl
2012-04-02 Name : Fedora Update for kdenetwork FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdenetwork_fc16.nasl
2012-04-02 Name : Fedora Update for kdemultimedia FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdemultimedia_fc16.nasl
2012-04-02 Name : Fedora Update for ksnapshot FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_ksnapshot_fc16.nasl
2012-04-02 Name : Fedora Update for kturtle FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kturtle_fc16.nasl
2012-04-02 Name : Fedora Update for kdepim FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdepim_fc16.nasl
2012-04-02 Name : Fedora Update for libkdcraw FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkdcraw_fc16.nasl
2012-04-02 Name : Fedora Update for libkdeedu FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkdeedu_fc16.nasl
2012-04-02 Name : Fedora Update for libkexiv2 FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkexiv2_fc16.nasl
2012-04-02 Name : Fedora Update for libkipi FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libkipi_fc16.nasl
2012-04-02 Name : Fedora Update for libksane FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_libksane_fc16.nasl
2012-04-02 Name : Fedora Update for okular FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_okular_fc16.nasl
2012-04-02 Name : Fedora Update for oxygen-icon-theme FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_oxygen-icon-theme_fc16.nasl
2012-04-02 Name : Fedora Update for rocs FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_rocs_fc16.nasl
2012-04-02 Name : Fedora Update for shared-desktop-ontologies FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_shared-desktop-ontologies_fc16.nasl
2012-04-02 Name : Fedora Update for smokegen FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_smokegen_fc16.nasl
2012-04-02 Name : Fedora Update for smokekde FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_smokekde_fc16.nasl
2012-04-02 Name : Fedora Update for smokeqt FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_smokeqt_fc16.nasl
2012-04-02 Name : Fedora Update for kdebase-workspace FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdebase-workspace_fc16.nasl
2012-04-02 Name : Fedora Update for kcolorchooser FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kcolorchooser_fc16.nasl
2012-04-02 Name : Fedora Update for kbruch FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kbruch_fc16.nasl
2012-04-02 Name : Fedora Update for kde-settings FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kde-settings_fc16.nasl
2012-04-02 Name : Fedora Update for kate FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kate_fc16.nasl
2012-04-02 Name : Fedora Update for kdeaccessibility FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeaccessibility_fc16.nasl
2012-04-02 Name : Fedora Update for kalzium FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kalzium_fc16.nasl
2012-04-02 Name : Fedora Update for kdeadmin FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeadmin_fc16.nasl
2012-04-02 Name : Fedora Update for kdeartwork FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeartwork_fc16.nasl
2012-04-02 Name : Fedora Update for kdebase-runtime FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdebase-runtime_fc16.nasl
2012-04-02 Name : Fedora Update for kalgebra FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kalgebra_fc16.nasl
2012-04-02 Name : Fedora Update for gwenview FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_gwenview_fc16.nasl
2012-04-02 Name : Fedora Update for kdeedu FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeedu_fc16.nasl
2012-04-02 Name : Fedora Update for cantor FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_cantor_fc16.nasl
2012-04-02 Name : Fedora Update for akonadi FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_akonadi_fc16.nasl
2012-04-02 Name : Fedora Update for kdegames FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegames_fc16.nasl
2012-04-02 Name : Fedora Update for kdegraphics-strigi-analyzer FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegraphics-strigi-analyzer_fc16.nasl
2012-04-02 Name : Fedora Update for PyKDE4 FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_PyKDE4_fc16.nasl
2012-04-02 Name : Fedora Update for step FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_step_fc16.nasl
2012-04-02 Name : Fedora Update for kdegraphics-thumbnailers FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegraphics-thumbnailers_fc16.nasl
2012-04-02 Name : Fedora Update for kdegraphics FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdegraphics_fc16.nasl
2012-03-29 Name : Fedora Update for kdelibs FEDORA-2012-3483
File : nvt/gb_fedora_2012_3483_kdelibs_fc15.nasl
2012-03-19 Name : Fedora Update for marble FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_marble_fc16.nasl
2012-03-19 Name : Fedora Update for kdelibs FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdelibs_fc16.nasl
2012-03-19 Name : Fedora Update for svgpart FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_svgpart_fc16.nasl
2012-03-19 Name : Fedora Update for kdepimlibs FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdepimlibs_fc16.nasl
2012-03-19 Name : Fedora Update for kdetoys FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdetoys_fc16.nasl
2012-03-19 Name : Fedora Update for parley FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_parley_fc16.nasl
2012-03-19 Name : Fedora Update for blinken FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_blinken_fc16.nasl
2012-03-19 Name : Fedora Update for kdeutils FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdeutils_fc16.nasl
2012-03-19 Name : Fedora Update for kstars FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kstars_fc16.nasl
2012-03-19 Name : Fedora Update for kdebase FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kdebase_fc16.nasl
2012-03-19 Name : Fedora Update for kig FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kig_fc16.nasl
2012-03-19 Name : Fedora Update for kolourpaint FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kolourpaint_fc16.nasl
2012-03-19 Name : Fedora Update for kamera FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kamera_fc16.nasl
2012-03-19 Name : Fedora Update for kanagram FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kanagram_fc16.nasl
2012-03-19 Name : Fedora Update for kross-interpreters FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kross-interpreters_fc16.nasl
2012-03-19 Name : Fedora Update for kde-l10n FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_kde-l10n_fc16.nasl
2012-03-19 Name : Fedora Update for ktouch FEDORA-2011-13417
File : nvt/gb_fedora_2011_13417_ktouch_fc16.nasl
2011-11-11 Name : CentOS Update for kdelibs CESA-2011:1385 centos4 i386
File : nvt/gb_CESA-2011_1385_kdelibs_centos4_i386.nasl
2011-11-03 Name : Mandriva Update for kdelibs4 MDVSA-2011:162 (kdelibs4)
File : nvt/gb_mandriva_MDVSA_2011_162.nasl
2011-10-31 Name : Ubuntu Update for kde4libs USN-1248-1
File : nvt/gb_ubuntu_USN_1248_1.nasl
2011-10-21 Name : RedHat Update for kdelibs and kdelibs3 RHSA-2011:1385-01
File : nvt/gb_RHSA-2011_1385-01_kdelibs_and_kdelibs3.nasl
2011-10-21 Name : CentOS Update for kdelibs CESA-2011:1385 centos5 i386
File : nvt/gb_CESA-2011_1385_kdelibs_centos5_i386.nasl
0000-00-00 Name : FreeBSD Ports: kdelibs
File : nvt/freebsd_kdelibs5.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
76016 KDE KSSL Certificate Text Format CN Field RTF Data Parsing Certificate Spoofi...

Nessus® Vulnerability Scanner

Date Description
2014-12-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-09.nasl - Type : ACT_GATHER_INFO
2014-06-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201406-34.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_4_kdelibs4-111010.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-1364.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-1385.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20111011_kdelibs_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20111019_kdelibs_and_kdelibs3_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-11-02 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-162.nasl - Type : ACT_GATHER_INFO
2011-10-26 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1248-1.nasl - Type : ACT_GATHER_INFO
2011-10-24 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_6d21a287fce011e0a82800235a5f2c9a.nasl - Type : ACT_GATHER_INFO
2011-10-20 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2011-1385.nasl - Type : ACT_GATHER_INFO
2011-10-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-1385.nasl - Type : ACT_GATHER_INFO
2011-10-12 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-1364.nasl - Type : ACT_GATHER_INFO
2011-10-05 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2011-13417.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
CONFIRM http://www.kde.org/info/security/advisory-20111003-1.txt
https://bugzilla.redhat.com/show_bug.cgi?id=743054
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2011:162
REDHAT http://www.redhat.com/support/errata/RHSA-2011-1364.html
http://www.redhat.com/support/errata/RHSA-2011-1385.html

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
Date Informations
2023-02-13 05:28:34
  • Multiple Updates
2023-02-02 21:28:47
  • Multiple Updates
2021-05-04 12:17:31
  • Multiple Updates
2021-04-22 01:20:51
  • Multiple Updates
2020-05-23 00:31:05
  • Multiple Updates
2016-04-26 21:03:29
  • Multiple Updates
2014-12-16 13:24:52
  • Multiple Updates
2014-07-01 13:24:56
  • Multiple Updates
2014-06-14 13:31:33
  • Multiple Updates
2014-02-17 11:05:04
  • Multiple Updates
2013-05-10 23:07:14
  • Multiple Updates