Fedora 30: FEDORA-2019-f9f78895c3 Critical: kdelibs3 Code Execution

Libraries for KDE 3:

KDE Libraries included: kdecore (KDE core library), kdeui (user interface),

kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking),

kspell (spelling checker), jscript (javascript), kab (addressbook),

kimgio (image manipulation).

This update fixes **CVE-2019-14744 (kconfig arbitrary shell code execution)** in

the KDE 3 compatibility version of kdelibs used by legacy KDE 3 applications.

The full list of fixes in this `kdelibs3` build: * fixes **CVE-2019-14744** -`kconfig`: malicious `.desktop` files (and others) would execute code. KConfig

had a well-meaning feature that allowed configuration files to execute arbitrary

shell commands. Unfortunately, this could be abused by untrusted `.desktop`

files to execute arbitrary code as the target user, without the user even

running the `.desktop` file. Therefore, this update removes that ill-fated

feature. (Backported by Kevin Kofler from upstream: `kf5-kconfig` fix by David

Faure, `kdelibs` 4 backport by Kai Uwe Broulik.) * adds native support for

**xdg-user-dirs** for *Desktop* and *Documents*, without shelling out to `xdg-user-dir` from the config file. This is needed due to the above security fix.

(This feature was previously implemented in the Fedora `kde-settings` by

shelling out to `xdg-user-dir` from the config file using the KConfig feature

removed above.) (Backported by Kevin Kofler from Trinity Desktop / Timothy

Pearson.) * fixes a **KJS double-free** that could crash legacy KDE 3

applications such as Quanta Plus when trying to execute JavaScript. (Backported

by OpenSUSE / Wolfgang Bauer from Trinity Desktop / Timothy Pearson.)

* Sat Aug 10 2019 Kevin Kofler - 3.5.10-101

- Backport CVE-2019-14744 fix by David Faure and Kai Uwe Broulik from kdelibs 4

- Backport native xdg-user-dirs support by Timothy Pearson from Trinity (needed

to fix the regression that would otherwise result from the above security fix)

- Backport KJS double-free fix by Timothy Pearson (backport by wbauer/OpenSUSE)

* Thu Jul 25 2019 Fedora Release Engineering - 3.5.10-100

- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

* Thu Apr 11 2019 Richard Shaw - 3.5.10-99

- Rebuild for OpenEXR 2.3.0.

[ 1 ] Bug #1740138 - CVE-2019-14744 kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction

https://bugzilla.redhat.com/show_bug.cgi?id=1740138

su -c 'dnf upgrade --advisory FEDORA-2019-f9f78895c3' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/