Stay Secure with the Latest Linux Advisories

security advisorysecurity issuemoderate threat

Mageia: 2021-0146 Moderate Security Advisory for Discover Application

Discover fetches the description and related texts of some applications/plugins from store.kde.org. That text is displayed to the user, after turning into a clickable link any part of the text that looks like a link. This is done for any kind of link, be it smb:// nfs:// etc. when in fact it only makes sense for http/https links. Opening links that the user has clicked on is not very . MGASA-2021-0146 - Updated discover package fixes a security vulnerability Publication date: 18 Mar 2021 URL: https://advisories.mageia.org/MGASA-2021-0146.html Type: security Affected Mageia releases: 7, 8 CVE: CVE-2021-28117 Discover fetches the description and related texts of some applications/plugins from store.kde.org. That text is displayed to the user, after turning into a clickable link any part of the text that looks like a link. This is done for any kind of link, be it smb:// nfs:// etc. when in fact it only makes sense for http/https links. Opening links that the user has clicked on is not very problematic but can be used to chain to other attack vectors. Given the intended functionality of the feature is just for http/https links it makes sense to do that verification (CVE-2021-28117). References: - https://bugs.mageia.org/show_bug.cgi?id=28581 - https://kde.org/info/security/advisory-20210310-1.txt - https://www.cve.org/CVERecord?id=CVE-2021-28117 SRPMS: - 8/core/discover-5.20.4-3.1.mga8 - 7/core/discover-5.15.4-2.2.mga7 . MGASA-2021-0146 addresses a vulnerability in discover for Mageia versions 7 and 8, ensuring enhanced security.. Mageia Security Update, Application Risk, Discover Architecture. . Severity: Important. LinuxSecurity.com Team

Mar 18, 2021 •Important Mageia