Your submission was sent successfully! Close

CVE-2011-3365

Published: 3 October 2011

The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

From the Ubuntu security team

Tim Brown discovered that KSSL in KDE-Libs did not properly perform input validation when displaying the common name (CN) for an SSL certificate. An attacker could exploit this to spoof the common name which could be used in an attack to trick the user into accepting a fraudulent certificate.

Notes

AuthorNote
jdstrand
also want 90607b28d21fefc43657ca08b889bdb174c31fab
Priority

Medium

Status

Package Release Status
kde4libs
Launchpad, Ubuntu, Debian
hardy Ignored
(reached end-of-life)
lucid
Released (4:4.4.5-0ubuntu1.2)
maverick
Released (4:4.5.5-0ubuntu2.1)
natty Not vulnerable
(4:4.6.5-0ubuntu1)
oneiric Not vulnerable
(4:4.7.2-0ubuntu1)
upstream
Released (4.7.2)