--------------------------------------------------------------------------------Fedora Update Notification
FEDORA-2019-9f2ee52c88
2019-08-19 02:28:49.021905
--------------------------------------------------------------------------------Name        : kdelibs3
Product     : Fedora 29
Version     : 3.5.10
Release     : 101.fc29
URL         : https://kde.org/
Summary     : KDE 3 Libraries
Description :
Libraries for KDE 3:
KDE Libraries included: kdecore (KDE core library), kdeui (user interface),
kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking),
kspell (spelling checker), jscript (javascript), kab (addressbook),
kimgio (image manipulation).

--------------------------------------------------------------------------------Update Information:

This update fixes **CVE-2019-14744 (kconfig arbitrary shell code execution)** in
the KDE 3 compatibility version of kdelibs used by legacy KDE 3 applications.
The full list of fixes in this `kdelibs3` build:  * fixes **CVE-2019-14744** -`kconfig`: malicious `.desktop` files (and others) would execute code. KConfig
had a well-meaning feature that allowed configuration files to execute arbitrary
shell commands. Unfortunately, this could be abused by untrusted `.desktop`
files to execute arbitrary code as the target user, without the user even
running the `.desktop` file. Therefore, this update removes that ill-fated
feature. (Backported by Kevin Kofler from upstream: `kf5-kconfig` fix by David
Faure, `kdelibs` 4 backport by Kai Uwe Broulik.) * adds native support for
**xdg-user-dirs** for *Desktop* and *Documents*, without shelling out to `xdg-user-dir` from the config file. This is needed due to the above security fix.
(This feature was previously implemented in the Fedora `kde-settings` by
shelling out to `xdg-user-dir` from the config file using the KConfig feature
removed above.) (Backported by Kevin Kofler from Trinity Desktop / Timothy
Pearson.) * fixes a **KJS double-free** that could crash legacy KDE 3
applications such as Quanta Plus when trying to execute JavaScript. (Backported
by OpenSUSE / Wolfgang Bauer from Trinity Desktop / Timothy Pearson.)
--------------------------------------------------------------------------------ChangeLog:

* Sat Aug 10 2019 Kevin Kofler  - 3.5.10-101
- Backport CVE-2019-14744 fix by David Faure and Kai Uwe Broulik from kdelibs 4
- Backport native xdg-user-dirs support by Timothy Pearson from Trinity (needed
  to fix the regression that would otherwise result from the above security fix)
- Backport KJS double-free fix by Timothy Pearson (backport by wbauer/OpenSUSE)
* Thu Jul 25 2019 Fedora Release Engineering  - 3.5.10-100
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Apr 11 2019 Richard Shaw  - 3.5.10-99
- Rebuild for OpenEXR 2.3.0.
* Fri Feb  1 2019 Fedora Release Engineering  - 3.5.10-98
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Sat Jan  5 2019 Kevin Kofler  - 3.5.10-97
- Rebuild for the new hardcoded qt3 build key in Rawhide
- Fix aarch64 FTBFS due to libtool not liking the file output on *.so files
--------------------------------------------------------------------------------References:

  [ 1 ] Bug #1740138 - CVE-2019-14744 kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction
        https://bugzilla.redhat.com/show_bug.cgi?id=1740138
--------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2019-9f2ee52c88' at the command
line. For more information, refer to the dnf documentation available at
https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/security/
--------------------------------------------------------------------------------_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/