Bug 1111022 (CVE-2014-3494)

The KDE project fixed the following issue:

""
Overview
========

The POP3 kioslave used by kmail will accept invalid certificates without
presenting a dialog to the user due a bug that leads to an inability to
display the dialog combined with an error in the way the result is checked.

Impact
======

This flaw allows an active attacker to perform MITM attacks against the
ioslave which could result in the leakage of sensitive data such as the
authentication details and the contents of emails.
""

Upstream notes this issue affected versions 4.10.95 to 4.13.2. It has been fixed in version 4.13.3. In addition to this, from an initial analysis it appears that only kdelibs in Fedora is affected (kdelibs3 should not be affected). kdelibs in Red Hat Enterprise Linux 5, 6, and 7 is older than the affected versions, and also appears to be missing the affected functionality.

Upstream advisory: http://www.kde.org/info/security/advisory-20140618-1.txt

Upstream commit: http://quickgit.kde.org/?p=kdelibs.git&a=commitdiff&h=bbae87dc1be3ae063796a582774bd5642cacdd5d&hp=1ccdb43ed3b32a7798eec6d39bb3c83a6e40228f