Slackware Security Update: KDE packages updated

phoeniXflame · 08-02-2003, 08:00 AM

I thought this might be helpful for everyone who isnt subscribed to the mailing lists ...

Quote:

[slackware-security] KDE packages updated (SSA:2003-213-01)

New KDE packages are available for Slackware 9.0. These address a
security issue where Konqueror may leak authentication credentials.

Here are the details from the Slackware 9.0 ChangeLog:
+--------------------------+
Fri Aug 1 15:15:51 PDT 2003
patches/packages/kde/*: Upgraded to KDE 3.1.3.
Note that this update addresses a security problem in Konqueror which may
cause authentication credentials to be leaked to an unintended website
through the HTTP-referer header when they have been entered into Konqueror
as a URL of the form:
http://user

assword@host/
For more information about this issue, please see the KDE advisory:
http://www.kde.org/info/security/adv...20030729-1.txt
We recommend that sites running KDE install this update.
(* Security fix *)
patches/packages/kdei/*: New internationalization packages for KDE 3.1.3.
+--------------------------+

WHERE TO FIND THE NEW PACKAGES:
+-----------------------------+

Updated packages for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackwar...ages/kde/*.tgz
ftp://ftp.slackware.com/pub/slackwar...ges/kdei/*.tgz

These packages are signed with our GPG key:
http://slackware.com/gpg-key

INSTALLATION INSTRUCTIONS:
+------------------------+

Upgrade using upgradepkg (as root):
upgradepkg *.tgz

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

BearClaw · 08-02-2003, 09:45 AM

I have the "current" kde pkg's installed, i.e. kde-3.1.2-i486 series. These pkg's are i386 at the slack-9 mirrors, although they are kde-3.1.3.

I was wondering if I should get the 3.1.3 series, or will the 3.1.3-kde pkg's be released for 'slack-current'?

Thanks, BC

Waldi · 08-04-2003, 09:03 AM

Warning !!!
I downloaded KDE3.1.3 from one of KDE's mirrors (Slack *.tgz version), upgraded and reboot. And it occurs, that CUPS support is missing in kdelibs!!! Luckily I had kdelibs from 3.1.2 and I copied missing files from that manually. It works, but I wasted some time to workout, what's going on.