KDE 3.0.4 Info Page
KDE 3.0.4 was released on October 9th, 2002. Read the official announcement.
This page will be updated to reflect changes in the status of 3.0.4 release so check back for new information.
Download and Installation
The translation package has been split into individual language packages so you can download only the translations you need.
The current list of available binary packages:
- 4.7: 4.7-STABLE
- Mandrake Linux:
- Red Hat:
- Slackware (Unofficial contribution):
- 8.1: Intel i386
- SuSE Linux (README):
- Turbolinux (README):
Several users have contributed packages for this release. You can find them in the contrib subdir of the KDE 3.0.4 download area.
Additional binary packages might become available in the coming weeks, as well as updates to the current packages.
Please report possible problems to firstname.lastname@example.org.
- Several vulnerabilites have been found in LISa/resLISa and the rlan:// protocol, including the possibility to escalate the privileges to root via a remote attack. See the detailed advisory for an explanation and instructions for immediate workaround. A patch is available for download. The use of LISa/resLISa is strongly discouraged in any security relevant area. Never make it available outside your local, trusted network.
- the rlogin protocol implementation in KIO allows remote command execution. See the detailed advisory for an explanation and instructions for immediate workaround. A patch is available for download.
Several shell escaping vulnerabilities have been found throughout KDE which allow a remote attacker to execute commands as the local user. Read the detailed advisory. It is strongly recommended to update to KDE 3.0.5a.
- Several problems with KDE's use of Ghostscript where discovered that allow the execution of arbitrary commands contained in PostScript (PS) or PDF files with the privileges of the victim. Read the detailed advisory. It is strongly recommended to update to KDE 3.0.5b
- A HTTP authentication credentials leak via the a "Referrer" was discovered by George Staikos in Konqueror. If the HTTP authentication credentials were part of the URL they would be possibly sent in the referer header to a 3rd party web site. Read the detailed advisory. KDE 3.1.3 and newer are not vulnerable.
This is a list of grave bugs and common pitfalls surfacing after the release date:
- currently none known.