PT-2014-1879 · Kde · Kdelibs

Published 2014-06-29 · Updated 2024-06-15 · CVE-2014-3494

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions kdelibs versions 4.10.95 through 4.12.5

Description The issue concerns the POP3 kioslave in kdelibs, where it fails to properly generate warning notifications, allowing man-in-the-middle attackers to obtain sensitive information via an invalid certificate. Multiple vulnerabilities in the kdelibs package can lead to a breach of protected information, and exploitation can be carried out remotely.

Recommendations For kdelibs versions 4.10.95 through 4.12.5, update to version 4.13.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

BDU:2015-09700

CVE-2014-3494

MGASA-2014-0432

OPENSUSE-SU-2024:10011-1

Affected Products

Kdelibs

References · 51

• 🔥 http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f · Exploit
• https://advisories.mageia.org/MGASA-2014-0432.html · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-October/140293.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3494 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-September/139445.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3494 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10011-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09700 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0432 · Vendor Advisory
• http://kde.org/info/security/advisory-20140618-1.txt · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136758.html · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-July/134961.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3494 · Security Note
• https://ubuntu.com/security/CVE-2014-3494 · Vendor Advisory