Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 3 articles for you...
89
security advisoryFedoracode executionFedora 30: FEDORA-2019-f9f78895c3 Critical: kdelibs3 Code Execution
This update fixes **CVE-2019-14744 (kconfig arbitrary shell code execution)** in the KDE 3 compatibility version of kdelibs used by legacy KDE 3 applications. The full list of fixes in this `kdelibs3` build: * fixes **CVE-2019-14744** - `kconfig`: malicious `.desktop` files (and others) would execute code. KConfig had a well-meaning feature that allowed configuration files to execute arbitrary. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-f9f78895c3 2019-08-19 01:01:06.548912 --------------------------------------------------------------------------------Name : kdelibs3 Product : Fedora 30 Version : 3.5.10 Release : 101.fc30 URL : https://kde.org/ Summary : KDE 3 Libraries Description : Libraries for KDE 3: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). --------------------------------------------------------------------------------Update Information: This update fixes **CVE-2019-14744 (kconfig arbitrary shell code execution)** in the KDE 3 compatibility version of kdelibs used by legacy KDE 3 applications. The full list of fixes in this `kdelibs3` build: * fixes **CVE-2019-14744** -`kconfig`: malicious `.desktop` files (and others) would execute code. KConfig had a well-meaning feature that allowed configuration files to execute arbitrary shell commands. Unfortunately, this could be abused by untrusted `.desktop` files to execute arbitrary code as the target user, without the user even running the `.desktop` file. Therefore, this update removes that ill-fated feature. (Backported by Kevin Kofler from upstream: `kf5-kconfig` fix by David Faure, `kdelibs` 4 backport by Kai Uwe Broulik.) * adds native support for **xdg-user-dirs** for *Desktop* and *Documents*, without shelling outto `xdg-user-dir` from the config file. This is needed due to the above security fix. (This feature was previously implemented in the Fedora `kde-settings` by shelling out to `xdg-user-dir` from the config file using the KConfig feature removed above.) (Backported by Kevin Kofler from Trinity Desktop / Timothy Pearson.) * fixes a **KJS double-free** that could crash legacy KDE 3 applications such as Quanta Plus when trying to execute JavaScript. (Backported by OpenSUSE / Wolfgang Bauer from Trinity Desktop / Timothy Pearson.) --------------------------------------------------------------------------------ChangeLog: * Sat Aug 10 2019 Kevin Kofler - 3.5.10-101 - Backport CVE-2019-14744 fix by David Faure and Kai Uwe Broulik from kdelibs 4 - Backport native xdg-user-dirs support by Timothy Pearson from Trinity (needed to fix the regression that would otherwise result from the above security fix) - Backport KJS double-free fix by Timothy Pearson (backport by wbauer/OpenSUSE) * Thu Jul 25 2019 Fedora Release Engineering - 3.5.10-100 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Thu Apr 11 2019 Richard Shaw - 3.5.10-99 - Rebuild for OpenEXR 2.3.0. --------------------------------------------------------------------------------References: [ 1 ] Bug #1740138 - CVE-2019-14744 kdelibs: malicious desktop files and configuration files lead to code execution with minimal user interaction https://bugzilla.redhat.com/show_bug.cgi?id=1740138 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-f9f78895c3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Aug 18, 2019
•Critical
Fedora
89
security advisorycritical issueinformation leakFedora 25: 2017-03-12 Critical kdelibs3 Update for Leak Issues
This kdelibs3 (KDE 3 compatibility libraries) update fixes the security issues: * CVE-2016-6232 (karchive): Extraction of tar files possible to arbitrary system locations * CVE-2017-6410 (kio): Information Leak when accessing https when using a malicious PAC file for the KDE 3 compatibility libraries. (Security updates for KDE Frameworks 5 (kf5-karchive resp. kf5-kio) and for the KDE 4. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-4f4eef4791 2017-03-12 16:21:58.067358 -------------------------------------------------------------------------------- Name : kdelibs3 Product : Fedora 25 Version : 3.5.10 Release : 84.fc25 URL : https://kde.org/ Summary : KDE 3 Libraries Description : Libraries for KDE 3: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). -------------------------------------------------------------------------------- Update Information: This kdelibs3 (KDE 3 compatibility libraries) update fixes the security issues: * CVE-2016-6232 (karchive): Extraction of tar files possible to arbitrary system locations * CVE-2017-6410 (kio): Information Leak when accessing https when using a malicious PAC file for the KDE 3 compatibility libraries. (Security updates for KDE Frameworks 5 (kf5-karchive resp. kf5-kio) and for the KDE 4 compatibility libraries (kdelibs 4) have already been submitted.) In addition, the KDE 3 compatibility version of KCrash was modified to use the DrKonqi from Plasma 5 rather than from kde-runtime 4. (The original KDE 3 DrKonqi was already dropped years ago.) The kde-runtime 4 DrKonqi is not installed by default and will be removed entirely in future Fedora versions, the Plasma 5 version of DrKonqi can also be used for legacyapplications. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1427808 - CVE-2017-6410 kf5-kio, kdelibs: Information Leak when accessing https when using a malicious PAC file https://bugzilla.redhat.com/show_bug.cgi?id=1427808 [ 2 ] Bug #1357410 - CVE-2016-6232 kf5-karchive: Extraction of tar files possible to arbitrary system locations https://bugzilla.redhat.com/show_bug.cgi?id=1357410 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade kdelibs3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Mar 12, 2017
•Critical
Fedora
89
security advisorymoderateinformation leakFedora 24 Advisory: Kdelibs3 Moderate Risk - Information Leak Issue
This kdelibs3 (KDE 3 compatibility libraries) update fixes the security issues: * CVE-2016-6232 (karchive): Extraction of tar files possible to arbitrary system locations * CVE-2017-6410 (kio): Information Leak when accessing https when using a malicious PAC file for the KDE 3 compatibility libraries. (Security updates for KDE Frameworks 5 (kf5-karchive resp. kf5-kio) and for the KDE 4. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2017-01eed6fe8c 2017-03-12 16:20:17.332924 -------------------------------------------------------------------------------- Name : kdelibs3 Product : Fedora 24 Version : 3.5.10 Release : 84.fc24 URL : https://kde.org/ Summary : KDE 3 Libraries Description : Libraries for KDE 3: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). -------------------------------------------------------------------------------- Update Information: This kdelibs3 (KDE 3 compatibility libraries) update fixes the security issues: * CVE-2016-6232 (karchive): Extraction of tar files possible to arbitrary system locations * CVE-2017-6410 (kio): Information Leak when accessing https when using a malicious PAC file for the KDE 3 compatibility libraries. (Security updates for KDE Frameworks 5 (kf5-karchive resp. kf5-kio) and for the KDE 4 compatibility libraries (kdelibs 4) have already been submitted.) In addition, the KDE 3 compatibility version of KCrash was modified to use the DrKonqi from Plasma 5 rather than from kde-runtime 4. (The original KDE 3 DrKonqi was already dropped years ago.) The kde-runtime 4 DrKonqi is not installed by default and will be removed entirely in future Fedora versions, the Plasma 5 version of DrKonqi can also be used for legacyapplications. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1427808 - CVE-2017-6410 kf5-kio, kdelibs: Information Leak when accessing https when using a malicious PAC file https://bugzilla.redhat.com/show_bug.cgi?id=1427808 [ 2 ] Bug #1357410 - CVE-2016-6232 kf5-karchive: Extraction of tar files possible to arbitrary system locations https://bugzilla.redhat.com/show_bug.cgi?id=1357410 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade kdelibs3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Mar 12, 2017
•Important
Fedora
89
security advisorysoftware updateFedoraFedora 22 kdelibs3 Moderate Advisory CVE-2015-7543 IPC Risk
Security fix for CVE-2015-7543 in kdelibs3 (the KDE 3 compatibility version of kdelibs): A temporary directory was being created insecurely using mktemp and mkdir, allowing an attacker to hijack the temporary directory and thus the inter-process communication (IPC). This update fixes the temporary directory creation to use the safe mkdtemp function instead.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-2f4b92ed2e 2015-12-30 17:33:17.150885 -------------------------------------------------------------------------------- Name : kdelibs3 Product : Fedora 22 Version : 3.5.10 Release : 71.fc22 URL : https://kde.org/ Summary : KDE 3 Libraries Description : Libraries for KDE 3: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2015-7543 in kdelibs3 (the KDE 3 compatibility version of kdelibs): A temporary directory was being created insecurely using mktemp and mkdir, allowing an attacker to hijack the temporary directory and thus the inter-process communication (IPC). This update fixes the temporary directory creation to use the safe mkdtemp function instead. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1280543 - CVE-2015-7543 arts,kdelibs3: Use of mktemp(3) allows attacker to hijack the IPC https://bugzilla.redhat.com/show_bug.cgi?id=1280543 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update kdelibs3' at the command line. For more information, refer to "Managing Software with yum", available at . All packages aresigned with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Dec 30, 2015
•Important
Fedora
89
security advisorysoftware updateFedoraFedora 23 Update: kdelibs3 Critical Fix for IPC Hijacking
Security fix for CVE-2015-7543 in kdelibs3 (the KDE 3 compatibility version of kdelibs): A temporary directory was being created insecurely using mktemp and mkdir, allowing an attacker to hijack the temporary directory and thus the inter-process communication (IPC). This update fixes the temporary directory creation to use the safe mkdtemp function instead.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-6e50918d8e 2015-12-29 18:54:14.973821 -------------------------------------------------------------------------------- Name : kdelibs3 Product : Fedora 23 Version : 3.5.10 Release : 71.fc23 URL : https://kde.org/ Summary : KDE 3 Libraries Description : Libraries for KDE 3: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2015-7543 in kdelibs3 (the KDE 3 compatibility version of kdelibs): A temporary directory was being created insecurely using mktemp and mkdir, allowing an attacker to hijack the temporary directory and thus the inter-process communication (IPC). This update fixes the temporary directory creation to use the safe mkdtemp function instead. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1280543 - CVE-2015-7543 arts,kdelibs3: Use of mktemp(3) allows attacker to hijack the IPC https://bugzilla.redhat.com/show_bug.cgi?id=1280543 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update kdelibs3' at the command line. For more information, refer to "Managing Software with yum", available at . All packages aresigned with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Dec 29, 2015
•Critical
Fedora
200
security advisorymoderatekdelibsResearching Scientific Linux: Security Update for kdelibs CVE-2011-3365
Moderate: kdelibs and kdelibs3 security update. Date: Wed, 19 Oct 2011 22:42:29 -0500 Reply-To:
Oct 19, 2011
•Important
Scientific Linux
89
security advisorysoftware updateFedoraFedora 10 kdelibs3 Critical Advisory: SSL Certificate Validation Bug
This update fixes CVE-2009-2702, a security issue where SSL certificates containing embedded NUL characters would falsely pass validation when they're actually invalid, for the KDE 3 compatibility version of kdelibs.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-9400 2009-09-09 00:47:08 -------------------------------------------------------------------------------- Name : kdelibs3 Product : Fedora 10 Version : 3.5.10 Release : 13.fc10.1 URL : https://kde.org/ Summary : K Desktop Environment 3 - Libraries Description : Libraries for the K Desktop Environment 3: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). -------------------------------------------------------------------------------- Update Information: This update fixes CVE-2009-2702, a security issue where SSL certificates containing embedded NUL characters would falsely pass validation when they're actually invalid, for the KDE 3 compatibility version of kdelibs. -------------------------------------------------------------------------------- ChangeLog: * Sun Sep 6 2009 Kevin Kofler - 3.5.10-13.1 - fix for CVE-2009-2702 * Sun Jul 26 2009 Kevin Kofler - 3.5.10-13 - fix CVE-2009-2537 - select length DoS - fix CVE-2009-1725 - crash, possible ACE in numeric character references - fix CVE-2009-1690 - crash, possible ACE in KHTML ( . Resolves a problem related to the validation of SSL certificates within the kdelibs3 libraries for Fedora 10, specifically addressing the kdelibs3-3.5.10-13 version.. KDE Libraries,kdelibs3,Fedora 10,SSL Validation Issue,security advisory. . Severity: Critical. LinuxSecurity.com Team
Sep 08, 2009
•Critical
Fedora
89
security advisoryupdatecriticalFedora 11: 2009-9391 Critical: Kdelibs3 SSL Certificate Validation Fault
This update fixes CVE-2009-2702, a security issue where SSL certificates containing embedded NUL characters would falsely pass validation when they're actually invalid, for the KDE 3 compatibility version of kdelibs.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-9391 2009-09-09 00:46:03 -------------------------------------------------------------------------------- Name : kdelibs3 Product : Fedora 11 Version : 3.5.10 Release : 13.fc11.1 URL : https://kde.org/ Summary : K Desktop Environment 3 - Libraries Description : Libraries for the K Desktop Environment 3: KDE Libraries included: kdecore (KDE core library), kdeui (user interface), kfm (file manager), khtmlw (HTML widget), kio (Input/Output, networking), kspell (spelling checker), jscript (javascript), kab (addressbook), kimgio (image manipulation). -------------------------------------------------------------------------------- Update Information: This update fixes CVE-2009-2702, a security issue where SSL certificates containing embedded NUL characters would falsely pass validation when they're actually invalid, for the KDE 3 compatibility version of kdelibs. -------------------------------------------------------------------------------- ChangeLog: * Sun Sep 6 2009 Kevin Kofler - 3.5.10-13.1 - fix for CVE-2009-2702 * Sun Jul 26 2009 Kevin Kofler - 3.5.10-13 - fix CVE-2009-2537 - select length DoS - fix CVE-2009-1725 - crash, possible ACE in numeric character references - fix CVE-2009-1690 - crash, possible ACE in KHTML ( . Security patch for kdelibs3 released on Fedora 11 to resolve critical SSL certificate verification vulnerability.. Fedora Update,kdelibs3 fixes,SSL vulnerabilities. . Severity: Critical. LinuxSecurity.com Team
Sep 08, 2009
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!