Security Update for kde4libs
Summary
DLA-952-1: kde4libs - security update. Affects kde4libs versions < 4:4.8.4-4+deb7u3. Fixed in 4:4.8.4-4+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
kde4libs is the core library for all KDE 4 applications. It provides essential functionality and components for the KDE desktop environment. This vulnerability affects version 4:4.8.4-4+deb7u3 of the kde4libs package in Debian 7 Wheezy.
Vulnerability Detail
The kde4libs package is affected by multiple vulnerabilities:
-
CVE-2017-6410: Itzik Kotler, Yonatan Fridburg, and Amit Klein of Safebreach Labs discovered that URLs are not properly sanitized before being passed to FindProxyForURL. This could allow a remote attacker to obtain sensitive information via a crafted PAC file.
-
CVE-2017-8422: Sebastian Krahmer from SUSE found a logic flaw in the KAuth framework, where the service invoking dbus is not properly checked. This flaw enables an attacker to spoof the identity of the caller and gain root privileges from an unprivileged account.
-
CVE-2013-2074: KIO, a component of kde4libs, was found to expose web authentication credentials in certain error cases.
How To Fix
Minimum fixed version
4:4.8.4-4+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kde4libsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple vulnerabilities have been discovered in kde4libs, the core libraries for all KDE 4 applications. These vulnerabilities could allow remote attackers to obtain sensitive information and gain root privileges. It is crucial to upgrade your kde4libs packages to version 4:4.8.4-4+deb7u3 or later to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kde4libs →
FAQ
kde4libs is the core library for all KDE 4 applications. It provides essential functionality and components for the KDE desktop environment.
CVE-2017-6410 could allow a remote attacker to obtain sensitive information by exploiting a flaw in URL sanitization.
You can check the version of kde4libs installed on your system by running the following command:
$ dpkg -l kde4libs
No, there is no known workaround for CVE-2017-8422. It is recommended to upgrade to the fixed version of kde4libs.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link:
Related vulnerabilities
Recent vulnerabilities recorded for kde4libs.
