Fluid Attacks Database

Description

The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel5	kdelibs	<6:3.5.4-26.el5_7.1	6:3.5.4-26.el5_7.1
rpm rhel6	kdelibs	<6:4.3.4-11.el6_1.4	6:4.3.4-11.el6_1.4
rpm rhel6	kdelibs3	<0:3.5.10-24.el6_1.1	0:3.5.10-24.el6_1.1

Aliases

1. CVE-2011-33652. NVD-2011-33653. OSV-2011-3365

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.