Alerts This Week
Warning Icon 1 424
Alerts This Week
Warning Icon 1 424

Mageia 9: Serious Remote Code Execution Flaw in Konsole MGASA-2025-0308

mageia
Calendar Grey November 21, 2025
Dist Mageia Esm H88
Konsole updates address critical remote code execution vulnerability affecting Mageia users. Urgent patching recommended.
MGASA-2025-0308 - Updated konsole packages fix security vulnerability

Summary

Description: KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that binary is not available, Konsole falls back to using /bin/bash for the given arguments (i.e., the URL) provided. This allows an attacker to execute arbitrary code. (CVE-2025-49091)

References

- https://bugs.mageia.org/show_bug.cgi?id=34364

- https://www.openwall.com/lists/oss-security/2025/06/10/5

-

- https://www.cve.org/CVERecord?id=CVE-2025-49091

Topics%20covered

Topics Covered

security advisory remote code execution important application update Mageia konsole

Resolution

SRPMS

- 9/core/konsole-23.04.3-1.2.mga9

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 21 Nov 2025
URL: https://advisories.mageia.org/MGASA-2025-0308.html
Type: security
CVE: CVE-2025-49091

Topics%20covered

Topics Covered

security advisory remote code execution important application update Mageia konsole

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here