[SECURITY] Fedora 10 Update: kdelibs3-3.5.10-13.fc10

Tue Jul 28 18:28:27 UTC 2009

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2009-8020
2009-07-27 21:06:00
--------------------------------------------------------------------------------

Name        : kdelibs3
Product     : Fedora 10
Version     : 3.5.10
Release     : 13.fc10
URL         : http://www.kde.org/
Summary     : K Desktop Environment 3 - Libraries
Description :
Libraries for the K Desktop Environment 3:
KDE Libraries included: kdecore (KDE core library), kdeui (user interface),
kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking),
kspell (spelling checker), jscript (javascript), kab (addressbook),
kimgio (image manipulation).

--------------------------------------------------------------------------------
Update Information:

This update fixes several security issues in the KDE 3 compatibility version of
KHTML (CVE-2009-1725, CVE-2009-1690, CVE-2009-1687, CVE-2009-1698,
CVE-2009-2537) which may lead to a denial of service or potentially even
arbitrary code execution.    In addition, the package was fixed to build with
the latest version of automake, and the following fixes and improvements were
merged from the Fedora 11 package:  * slight speedup to /etc/profile.d/kde.sh,
* fixed unowned directories,  * fixed harmless (as the file contents match) file
conflicts with KDE 4.2.x,  * fixed build with GCC 4.4 (but this package is built
with Fedora 10's GCC 4.3.2),  * moved Qt Designer plugins to the runtime package
as they can be needed at runtime (e.g. by PyKDE programs),  * kdelibs3-apidocs
is now a noarch subpackage.
--------------------------------------------------------------------------------
ChangeLog:

* Sun Jul 26 2009 Kevin Kofler <Kevin at tigcc.ticalc.org> - 3.5.10-13
- fix CVE-2009-2537 - select length DoS
- fix CVE-2009-1725 - crash, possible ACE in numeric character references
- fix CVE-2009-1690 - crash, possible ACE in KHTML (<head> use-after-free)
- fix CVE-2009-1687 - possible ACE in KJS (FIXME: still crashes?)
- fix CVE-2009-1698 - crash, possible ACE in CSS style attribute handling
* Fri Jul 24 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 3.5.10-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
* Sat Jul 18 2009 Rex Dieter <rdieter at fedoraproject.org> - 3.5.10-12 
- FTBFS kdelibs3-3.5.10-11.fc11 (#511571)
- -devel: Requires: %{name}%_isa ...
* Sun Apr 19 2009 Rex Dieter <rdieter at fedoraproject.org> - 3.5.10-11
- update openssl patch (for 0.9.8k)
* Thu Apr 16 2009 Rex Dieter <rdieter at fedoraproject.org> - 3.5.10-10
- move designer plugins to runtime (#487622)
- make -apidocs noarch
* Mon Mar  2 2009 Than Ngo <than at redhat.com> - 3.5.10-9
- enable -apidocs
* Fri Feb 27 2009 Rex Dieter <rdieter at fedoraproject.org> - 3.5.10-8
- disable -apidocs (f11+, #487719)
- cleanup unused kdeui_symlink hack baggage
* Wed Feb 25 2009 Than Ngo <than at redhat.com> - 3.5.10-7
- fix files conflicts with 4.2.x
- fix build issue with gcc-4.4
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 3.5.10-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
* Sat Jan 31 2009 Rex Dieter <rdieter at fedoraproject.org> - 6:3.5.10-5
- unowned dirs (#483318)
* Sat Jan 10 2009 Ville Skyttä <ville.skytta at iki.fi> - 6:3.5.10-4
- Slight speedup to profile.d/kde.sh (#465370).
* Mon Dec 15 2008 Kevin Kofler <Kevin at tigcc.ticalc.org> 3.5.10-3
- update the KatePart latex.xml syntax definition to the version from Kile 2.0.3
* Thu Dec  4 2008 Rex Dieter <rdieter at fedoraproject.org> 3.5.10-2
- omit libkscreensaver (F9+)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #513813 - CVE-2009-1725: KHTML: improper handling of numeric character references (ACE, DoS)
        https://bugzilla.redhat.com/show_bug.cgi?id=513813
  [ 2 ] Bug #505571 - CVE-2009-1690 kdelibs: KHTML Incorrect handling <head> element content once the <head> element was removed (DoS, ACE)
        https://bugzilla.redhat.com/show_bug.cgi?id=505571
  [ 3 ] Bug #506453 - CVE-2009-1687 kdelibs: Integer overflow in KJS JavaScript garbage collector
        https://bugzilla.redhat.com/show_bug.cgi?id=506453
  [ 4 ] Bug #506469 - CVE-2009-1698 kdelibs: KHTML CSS parser - incorrect handling CSS "style" attribute content (DoS, ACE)
        https://bugzilla.redhat.com/show_bug.cgi?id=506469
  [ 5 ] Bug #512911 - CVE-2009-2537 Konqueror: DoS via large length property of a Select object
        https://bugzilla.redhat.com/show_bug.cgi?id=512911
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update kdelibs3' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------