USN-4100-1: KConfig and KDE libraries vulnerabilities
16 August 2019
KConfig and KDE libraries could be made to crash or run programs if it opened a specially crafted file.
Releases
Packages
Details
It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)
It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 19.04
Ubuntu 18.04
Ubuntu 16.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-3042-1: kdelibs-bin, libkutils4, libkrosscore4, libkemoticons4, libkpty4, libknotifyconfig4, libkhtml5, libkmediaplayer4, libkunitconversion4, libnepomukquery4a, libsolid4, kdelibs5-data, libkjsapi4, libktexteditor4, libkdeclarative5, libnepomukutils4, libkdewebkit5, libkcmutils4, kde4libs, libkdnssd4, libkprintutils4, libkjsembed4, libknewstuff3-4, kdelibs5-dev, libkdesu5, libknewstuff2-4, libkntlm4, libkdecore5, kdoctools, libkidletime4, libkparts4, libkfile4, libkdeui5, libnepomuk4, kdelibs5-plugins, libkde3support4, libkimproxy4, libplasma3, libkrossui4, libthreadweaver4, libkio5