mailing list archives
Low severity flaw in various applications including KSSL, Rekonq, Arora, Psi IM
From: Tim Brown <timb () nth-dimension org uk>
Date: Fri, 7 Oct 2011 10:35:50 +0100
I recently discovered that various Qt applications including KSSL (the KDE
class library responsible for SSL negotiation), Rekonq, Arora and Psi IM are
vulnerable to UI spoofing due to their use of QLabel objects to render
externally controlled security critical information. The primary area of
concern at this time relates to the named applications SSL certificate dialogue
UI however other similar dialogue boxes may also be vulnerable.
After discussions with Nokia, KDE and the Rekonq developers the following
CVEs have been assigned to this issue:
* KSSL - CVE-2011-3365
* Rekonq - CVE-2011-3366
* Arora - CVE-2011-3367
Note that no CVE has yet been assigned to Psi IM. Nokia have also
updated the QLabel class section of the Qt documentation to provide
updated security information regarding this issue.
<mailto:timb () nth-dimension org uk>
Description: This is a digitally signed message part.
- Low severity flaw in various applications including KSSL, Rekonq, Arora, Psi IM Tim Brown (Oct 07)