Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Gentoo 201402-20 High: KVIrc Remote Code Execution Threat

gentoo
Calendar Grey February 21, 2014
Scroller Gentoo
Numerous vulnerabilities in KVIrc could permit remote code execution. Act promptly to enhance security and address severe risks to protect your environment.
Multiple vulnerabilities have been found in KVIrc, the worst of which allows remote attackers to execute arbitrary code.

Summary

Multiple vulnerabilities have been discovered in KVIrc. Please review the CVE identifiers referenced below for details.

Topics%20covered

Topics Covered

security advisory high severity security issue gentoo remote code execution kvirc

Resolution

All KVIrc users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/kvirc-4.1_pre4693"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since July 29, 2010. It is likely that your system is already no longer affected by this issue.

References

[ 1 ] CVE-2010-2451 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2451 [ 2 ] CVE-2010-2452 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2452 [ 3 ] CVE-2010-2785 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2785

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201402-20
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: KVIrc: Multiple vulnerabilities
Date: February 21, 2014
Bugs: #326149, #330111
ID: 201402-20

Topics%20covered

Topics Covered

security advisory high severity security issue gentoo remote code execution kvirc

Synopsis

Multiple vulnerabilities have been found in KVIrc, the worst of which allows remote attackers to execute arbitrary code.

Background

KVIrc is a free portable IRC client based on Qt.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-irc/kvirc < 4.1_pre4693 >= 4.1_pre4693

Impact

===== A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or overwrite arbitrary files.

Workaround

There is no known workaround at this time.