diff -Nru kde4libs-4.5.1/debian/changelog kde4libs-4.5.1/debian/changelog --- kde4libs-4.5.1/debian/changelog 2010-10-11 14:10:25.000000000 +0200 +++ kde4libs-4.5.1/debian/changelog 2011-04-10 11:38:50.000000000 +0200 @@ -1,3 +1,12 @@ +kde4libs (4:4.5.1-0ubuntu9) maverick-security; urgency=low + + * SECURITY UPDATE: fix XSS vulnerability in Konqueror's error pages + - debian/patches/security_02_CVE-2011-1168.diff: upstream patch + - CVE-2011-1168 + - LP: #743669 + + -- Felix Geyer Sun, 10 Apr 2011 11:37:53 +0200 + kde4libs (4:4.5.1-0ubuntu8) maverick-proposed; urgency=low * Add kubuntu_78_kate_buffer.diff from 4.5.2, fixes KDevelop's use of diff -Nru kde4libs-4.5.1/debian/patches/security_02_CVE-2011-1168.diff kde4libs-4.5.1/debian/patches/security_02_CVE-2011-1168.diff --- kde4libs-4.5.1/debian/patches/security_02_CVE-2011-1168.diff 1970-01-01 01:00:00.000000000 +0100 +++ kde4libs-4.5.1/debian/patches/security_02_CVE-2011-1168.diff 2011-04-10 11:37:01.000000000 +0200 @@ -0,0 +1,23 @@ +From: Jeff Mitchell +Date: Sun, 27 Mar 2011 13:08:44 +0000 +Subject: Fix CVE-2011-1168. Credit to Tim Brown of Nth Dimension. +X-Git-Url: http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=da03cc03d46e3d240f0e16c08f29e67518acb7e1 +--- +Fix CVE-2011-1168. Credit to Tim Brown of Nth Dimension. +--- + + +--- a/khtml/khtml_part.cpp ++++ b/khtml/khtml_part.cpp +@@ -1803,7 +1803,10 @@ void KHTMLPart::htmlError( int errorCode + stream >> errorName >> techName >> description >> causes >> solutions; + + QString url, protocol, datetime; +- url = Qt::escape( reqUrl.prettyUrl() ); ++ ++ // This is somewhat confusing, but we have to escape the externally- ++ // controlled URL twice: once for i18n, and once for HTML. ++ url = Qt::escape( Qt::escape( reqUrl.prettyUrl() ) ); + protocol = reqUrl.protocol(); + datetime = KGlobal::locale()->formatDateTime( QDateTime::currentDateTime(), + KLocale::LongDate ); diff -Nru kde4libs-4.5.1/debian/patches/series kde4libs-4.5.1/debian/patches/series --- kde4libs-4.5.1/debian/patches/series 2010-10-07 12:52:04.000000000 +0200 +++ kde4libs-4.5.1/debian/patches/series 2011-04-10 11:37:50.000000000 +0200 @@ -33,3 +33,4 @@ kubuntu_76_fix_install_plasmoid.diff kubuntu_77_no_kbookmark_write_error.diff kubuntu_78_kate_buffer.diff +security_02_CVE-2011-1168.diff