1
May
As we announced last week, the KDE Project has released kdelibs-2.1.2 to address a security issue and fix some bugs. Besides fixing the KDEsu security exploit, particularly joyful to many of you who use Konqueror will be the fix of the "protocol for http://x.y.z died unexpectedly" bug. "Read more" for the full text of the announcement, including a list of changes.
DATELINE APRIL 30, 2001
FOR IMMEDIATE RELEASE
SECURITY: New KDE Libraries Released
KDE Adds Security and Bug Fixes to Core Libraries
April 30, 2001 (The INTERNET).
The KDE
Project today announced the release of kdelibs 2.1.2,
a security and bugfix release of the core KDE libraries. The other
core KDE packages, including kdebase, have not been updated. The KDE Project
recommends that all KDE users upgrade to kdelibs 2.1.2 and KDE 2.1.1.
This release provides the following fixes:
- Security fixes:
- KDEsu. The KDEsu which shipped with earlier releases of KDE 2
writes a (very) temporary but world-readable file with authentication
information. A local user can potentially abuse this behavior to gain
access to the X server and, if KDEsu is used to perform tasks that require
root-access, can result in comprimise of the root account. - Bug fixes:
- kio_http. Fixed problems with "protocol for http://x.y.z died unexpectedly" and with proxy authentication with Konqueror.
- kparts. Fixed crash in KOffice 1.1 when splitting views.
- khtml. Fixed memory leak in Konqueror. Fixed minor HTML
rendering problems. - kcookiejar. Fixed minor problems with HTTP cookies.
- kconfig. Fixed problem with leading/trailing spaces in
configuration values. - kdebug. Fixed memory leak in debug output.
- klineedit. Fixed problem with klineedit emitting "return
pressed" twice.
For more information about the KDE 2.1 series, please see the
KDE 2.1.1
press release and the KDE
2.1.1 Info Page, which is an evolving FAQ about the latest stable release.
Information on using anti-aliased fonts with KDE is available
here.
Downloading and Compiling kdelibs 2.1.2
The source package for kdelibs 2.1.2 (including a diff file against 2.1.1) is
available for free download at
http://ftp.kde.org/stable/2.1.2/distribution/src/
or in the equivalent directory at one of the many KDE ftp server
mirrors. KDE 2.1.2 requires
qt-2.2.3, which is available from
Trolltech at
ftp://ftp.trolltech.com/qt/source/
under the name qt-x11-2.2.3.tar.gz,
although
qt-2.2.4or
qt-2.3.0is recommended (for anti-aliased fonts,
qt-2.3.0and XFree 4.0.3 or
newer is required).
kdelibs 2.1.2 will not work with versions of Qt older than 2.2.3.
For further instructions on compiling and installing KDE, please consult
the installation
instructions and, if you encounter problems, the
compilation FAQ.
Installing Binary Packages
Some distributors choose to provide binary packages of KDE for certain
versions of their distribution. Some of these binary packages for
kdelibs 2.1.2 will be available for free download under
http://ftp.kde.org/stable/2.1.2/distribution/
or under the equivalent directory at one of the many KDE ftp server
mirrors. Please note that the
KDE team is not responsible for these packages as they are provided by third
parties -- typically, but not always, the distributor of the relevant
distribution (if you have any questions, please read the
KDE Binary Packages Policy).
kdelibs 2.1.2 requires qt-2.2.3, the free version of which is available
from the above locations usually under the name qt-x11-2.2.3, although
qt-2.2.4 or qt-2.3.0 is recommended (for anti-aliased fonts,
qt-2.3.0 and XFree 4.0.3 or newer is required).
KDE 2.1.2 will not work with versions of Qt older than 2.2.3.
At the time of this release, pre-compiled packages are available for:
- Caldera eDesktop 2.4: i386
- Linux-Mandrake 7.2: i586
- RedHat Linux: 7.1: i386
Debian GNU/Linux stable (2.2): i386 and PPC; please also check the main directory for common files
-->
-->
FreeBSD
-->
Please check the servers periodically for pre-compiled packages for other
distributions. More binary packages may become available over the
coming days and weeks.
About KDE
KDE is an independent, collaborative project by hundreds of developers
worldwide to create a sophisticated, customizable and stable desktop environment
employing a component-based, network-transparent architecture.
KDE is working proof of the power of the Open Source "Bazaar-style" software
development model to create first-rate technologies on par with
and superior to even the most complex commercial software.
KDE and all its components are available for free under
Open Source licenses from the KDE server
and its mirrors and can
also be obtained on CD-ROM.
As a result of the dedicated efforts of hundreds of translators,
KDE is available in 34
languages and dialects. KDE includes the core KDE libraries, the core
desktop environment (including
Konqueror), developer packages
(including KDevelop), as well as the
over 100 applications from the other standard base KDE packages
(administration, games, graphics, multimedia, network, PIM and utilities).
For more information about KDE, please visit KDE's
web site.
More information about KDE 2 is available in two
(1,
2) slideshow
presentations and on
KDE's web site, including an evolving
FAQ to answer questions about
migrating to KDE 2.1 from KDE 1.x,
anti-aliased font tutorials, a
number of
screenshots, developer information and
a developer's
KDE 1 - KDE 2 porting guide.
Trademarks Notices.
KDE and K Desktop Environment are trademarks of KDE e.V.
Linux is a registered trademark of Linus Torvalds.
Unix is a registered trademark of The Open Group.
Trolltech and Qt are trademarks of Trolltech AS.
All other trademarks and copyrights referred to in this announcement are the property of their respective owners.
Press Contacts:
United States:
Kurt Granroth
granroth@kde.org
(1) 480 732 1752
Andreas Pour
pour@kde.org
(1) 917 312 3122
Europe (French and English):
David Faure
faure@kde.org
(44) 1225 837409
Europe (English and German):
Martin Konold
konold@kde.org
(49) 179 2252249
Comments
Re: SECURITY: New KDE Libraries Released
Dumb question:
what proper rpm syntax to install on stock suse 7.1 with kde 2.1.1?
thanks
Re: SECURITY: New KDE Libraries Released
rpm -Uvh
where filename is the package(s) you've downloaded.
you can also use yast.
Re: SECURITY: New KDE Libraries Released
That is what i do and got message "conflicts with file from package klibs-1.1.2-217"
Re: SECURITY: New KDE Libraries Released
Just use rpm -Uvh --force --nodeps *.rpm instead.
Rune
how to prove if installation was succesfull
Hello Rune Laursen,
i made what you wrote:
rpm -Uvh --force --nodeps kdelibs.rpm
kdelibs-devel-1.2.2-0.rpm
but i am not sure if it worked for two reasons
a: i installed the rpm with the name kdelibs.rpm instead of kdelibs-1.2.2.rpm (i suppose that makes a difference or doesn´t it)
b: i got lots of warnings like can not
overwrite *icons* because it is not empty
But my kde is still running
Thanks for any help
go on kde - you are just great
Re: SECURITY: New KDE Libraries Released
try removing this old version of kdelibs by running:
rpm -e klibs-1.1.2-217
it will probably give some dependency errors, because you may have old programs that use the old kdelibs installed. in this case, i recommend you to remove those packages too.
Re: SECURITY: New KDE Libraries Released
Isn't that the version of klibs that came with KDE 1.1? I'm not sure, but you probably need a 2.x version of KDE for the libraries to be applicable.
Doesn't work :-(
I get following compilation errors in khtml/dom:
In file included from libkhtmldom_la.all_cpp.cpp:4:
html_inline.cpp: In method `void DOM::HTMLAnchorElement::blur()':
html_inline.cpp:204: no matching function for call to `DOM::DocumentImpl::focusN
ode ()'
html_inline.cpp:205: no matching function for call to `DOM::DocumentImpl::setFoc
usNode (int)'
html_inline.cpp: In method `void DOM::HTMLAnchorElement::focus()':
html_inline.cpp:211: no matching function for call to `DOM::DocumentImpl::setFoc
usNode (DOM::ElementImpl *&)'
In file included from libkhtmldom_la.all_cpp.cpp:7:
html_document.cpp: In method `DOM::HTMLDocument::HTMLDocument()':
html_document.cpp:42: cannot allocate an object of type `DOM::HTMLDocumentImpl'
html_document.cpp:42: since the following virtual functions are abstract:
../../khtml/xml/dom_nodeimpl.h:110: class DOM::NodeImpl * DOM::NodeImpl::clo
neNode(bool, int &)
html_document.cpp: In method `DOM::HTMLDocument::HTMLDocument(KHTMLView *)':
html_document.cpp:50: cannot allocate an object of type `DOM::HTMLDocumentImpl'
html_document.cpp:50: since type `DOM::HTMLDocumentImpl' has abstract virtual
functions
In file included from libkhtmldom_la.all_cpp.cpp:16:
dom_doc.cpp: In method `DOM::Document::Document()':
dom_doc.cpp:91: cannot allocate an object of type `DOM::DocumentImpl'
dom_doc.cpp:91: since the following virtual functions are abstract:
../../khtml/xml/dom_nodeimpl.h:110: class DOM::NodeImpl * DOM::NodeImpl::clo
neNode(bool, int &)
dom_doc.cpp: In method `DOM::Document::Document(bool)':
dom_doc.cpp:100: cannot allocate an object of type `DOM::DocumentImpl'
dom_doc.cpp:100: since type `DOM::DocumentImpl' has abstract virtual functions
and so on.
I'm using gcc version 2.95.2 on FreeBSD 4.1.1.
Is it a known problem ?
Re: Doesn't work :-(
This looks like --enable-final breakage. Remove it from the configure arguments, and try again.
Waste of time
Why are they wasting their time fixing obscure security bugs when they should be trying to catch up to Ximian GNOME 1.4?
Troll
Is slashdot.org not enough fun anymore?
Re: Troll
To be honest I really think that /. suffers a lot less than here due to the mod system. The trolls have unfortunatly found a new home. Very good troll though.
Re: Waste of time
It's not a waste of time to fix the bugs. This is the sort of thing that makes KDE a stable, usable desktop for linux so it can help to enduce windows users to move accross.
Joe user won't change from microsoft if he thinks that the alternative is only trying to look good and not to atain stablility. Even though Windows is not as stable, the open source community has to try to dispell the inaccurate belief, among desktop users, that it is full of bugs. The KDE team are doing a good job of working towards this.
Well done guys, keep it up!
can we see you on stage ???
*ROTFL*...
this is really a good one !!! ;)
Re: Waste of time
Must be kidding, kde 2.1.1 overhelms Gnome 1.4...
Re: SECURITY: New KDE Libraries Released
Where are all the Mandrake 8.0 binary packages?? *sob*
Re: SECURITY: New KDE Libraries Released
Great work! I didn't look at the security
aspect but konqueror works much better now.
It was my main browser before but sometimes
didn't work with a site. I suppose there
are still sites that don't work but a quick
test for a few hours didn't find any. KDE is
so cool.
Guess I'll have to try Koffice sometime.
Dan Clayton