CVE-2011-3365

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2011-3365
The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://www.kde.org/info/security/advisory-20111003-1.txt Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:162
http://www.redhat.com/support/errata/RHSA-2011-1364.html
http://www.redhat.com/support/errata/RHSA-2011-1385.html
https://bugzilla.redhat.com/show_bug.cgi?id=743054 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:kde:kde_sc:4.6.0:*:*:*:*:*:*:*
cpe:2.3:a:kde:kde_sc:4.6.1:*:*:*:*:*:*:*
cpe:2.3:a:kde:kde_sc:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:kde:kde_sc:4.6.3:*:*:*:*:*:*:*
cpe:2.3:a:kde:kde_sc:4.6.4:*:*:*:*:*:*:*
cpe:2.3:a:kde:kde_sc:4.6.5:*:*:*:*:*:*:*
cpe:2.3:a:kde:kde_sc:4.7.0:*:*:*:*:*:*:*
cpe:2.3:a:kde:kde_sc:4.7.1:*:*:*:*:*:*:*
History

13 Feb 2023, 00:19

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2011-3365', 'name': 'https://access.redhat.com/security/cve/CVE-2011-3365', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2011:1364', 'name': 'https://access.redhat.com/errata/RHSA-2011:1364', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2011:1385', 'name': 'https://access.redhat.com/errata/RHSA-2011:1385', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2011-3365 kdelibs: input validation failure in KSSL The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.

02 Feb 2023, 15:15

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2011-3365 -
  • (MISC) https://access.redhat.com/errata/RHSA-2011:1364 -
  • (MISC) https://access.redhat.com/errata/RHSA-2011:1385 -
Summary The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text. CVE-2011-3365 kdelibs: input validation failure in KSSL
Information

Published : 2011-11-29 17:55

Updated : 2023-12-10 11:03

NVD link : CVE-2011-3365

Mitre link : CVE-2011-3365

CVE.ORG link : CVE-2011-3365

JSON object : View

Products Affected

kde

  • kde_sc
CWE
CWE-20

Improper Input Validation