Kdelibs; Rhsa-2009:1127: Critical Security Update; Kdenetwork; Rhba-2009:0452: Bug Fix Update - Red Hat ENTERPRISE LINUX 5.4 - TECHNICAL NOTES Manual

Chapter 1. Package Updates

1.107. kdelibs

1.107.1. RHSA-2009:1127: Critical security update

Important
This update has already been released (prior to the GA of this release) as the security
RHSA-2009:1127
errata
Updated kdelibs packages that fix multiple security issues are now available for Red Hat Enterprise
Linux 4 and 5.
This update has been rated as having critical security impact by the Red Hat Security Response
Team.
The kdelibs packages provide libraries for the K Desktop Environment (KDE).
A flaw was found in the way the KDE CSS parser handled content for the CSS "style" attribute. A
remote attacker could create a specially-crafted CSS equipped HTML page, which once visited by an
unsuspecting user, could cause a denial of service (Konqueror crash) or, potentially, execute arbitrary
code with the privileges of the user running Konqueror.
A flaw was found in the way the KDE HTML parser handled content for the HTML "head" element. A
remote attacker could create a specially-crafted HTML page, which once visited by an unsuspecting
user, could cause a denial of service (Konqueror crash) or, potentially, execute arbitrary code with the
privileges of the user running Konqueror.
An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the KDE
JavaScript garbage collector handled memory allocation requests. A remote attacker could create a
specially-crafted HTML page, which once visited by an unsuspecting user, could cause a denial of
service (Konqueror crash) or, potentially, execute arbitrary code with the privileges of the user running
Konqueror. (CVE-2009-1687
Users should upgrade to these updated packages, which contain backported patches to correct these
issues. The desktop must be restarted (log out, then log back in) for this update to take effect.

1.108. kdenetwork

1.108.1. RHBA-2009:0452: bug fix update

Note
This update has already been released (prior to the GA of this release) as FASTRACK
RHBA-2009:0452
errata
767
https://www.redhat.com/security/data/cve/CVE-2009-1698.html
768
https://www.redhat.com/security/data/cve/CVE-2009-1690.html
769
https://www.redhat.com/security/data/cve/CVE-2009-1687.html
114
766
(CVE-2009-1690
769
)
770
767
(CVE-2009-1698 )
768
)