CVE-2011-3365

Published: 03 October 2011

The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

From the Ubuntu security team

Tim Brown discovered that KSSL in KDE-Libs did not properly perform input validation when displaying the common name (CN) for an SSL certificate. An attacker could exploit this to spoof the common name which could be used in an attack to trick the user into accepting a fraudulent certificate.

Priority

Medium

Status

Package Release Status
kde4libs
Launchpad, Ubuntu, Debian
Upstream
Released (4.7.2)
Patches:
upstream: 9ca2b26fc67c3f921e1943c1725fca623e395854