Ubuntu 4100-1: Moderate KConfig And KDE Libraries Security Issues

ubuntu

August 19, 2019

KConfig and KDE libraries could be made to crash or run programs if it opened a specially crafted file.

Summary

KConfig and KDE libraries could be made to crash or run programs if it

opened a specially crafted file.

Software Description:

- kconfig: configuration settings framework for Qt

- kde4libs: KDE 4 core applications and libraries

Details:

It was discovered that KConfig and KDE libraries have a vulnerability

where an attacker could hide malicious code under desktop and

configuration files. (CVE-2019-14744)

It was discovered that KConfig allows remote attackers to write to

arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)

Topics Covered

security advisory remote access Ubuntu malicious code application crash KDE libraries KConfig

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  libkdecore5                     4:4.14.38-0ubuntu6.1
  libkf5configcore5               5.56.0-0ubuntu1.1

Ubuntu 18.04 LTS:
  libkdecore5                     4:4.14.38-0ubuntu3.1
  libkf5configcore5               5.44.0-0ubuntu1.1

Ubuntu 16.04 LTS:
  libkdecore5                     4:4.14.16-0ubuntu3.3
  libkf5configcore5               5.18.0-0ubuntu1.1

In general, a standard system update will make all the necessary changes.