Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia: 2020-0425 Moderate: GnuPG Kleopatra Remote Code Execution

mageia
Calendar Grey November 15, 2020
Dist Mageia Esm H88
MGASA-2022-0158 revised gpgme packages address a critical security flaw impacting GnuPG functionalities.
The Kleopatra component before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line op...

Summary

The Kleopatra component before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary library. (CVE-2020-24972).

References

- https://bugs.mageia.org/show_bug.cgi?id=27455

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IRIPL72WMXTVWS2M7WYV5SNPETYJ2YI7/

- https://www.cve.org/CVERecord?id=CVE-2020-24972

Topics%20covered

Topics Covered

security advisory update code execution remote attack mageia kleopatra

Resolution

SRPMS

- 7/core/kleopatra-19.04.0-1.1.mga7

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 15 Nov 2020
URL: https://advisories.mageia.org/MGASA-2020-0425.html
Type: security
CVE: CVE-2020-24972

Topics%20covered

Topics Covered

security advisory update code execution remote attack mageia kleopatra

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here