Your submission was sent successfully! Close

USN-4100-1: KConfig and KDE libraries vulnerabilities

16 August 2019

KConfig and KDE libraries could be made to crash or run programs if it opened a specially crafted file.

Releases

Packages

  • kconfig - configuration settings framework for Qt
  • kde4libs - KDE 4 core applications and libraries

Details

It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)

It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
Ubuntu 18.04
Ubuntu 16.04

In general, a standard system update will make all the necessary changes.

Related notices

  • USN-3042-1: libkutils4, libkdnssd4, libplasma3, libknewstuff2-4, libkntlm4, libkdecore5, libkmediaplayer4, libkdeui5, libthreadweaver4, libkrossui4, libkparts4, libsolid4, kdelibs5-data, libkjsapi4, libkcmutils4, kdoctools, libnepomukutils4, libknotifyconfig4, kdelibs5-plugins, libkimproxy4, libkfile4, libkpty4, libkdeclarative5, libkdesu5, libkrosscore4, libkprintutils4, libktexteditor4, libkidletime4, libkunitconversion4, libkio5, libknewstuff3-4, kdelibs5-dev, libkdewebkit5, libkjsembed4, libkde3support4, kde4libs, libkemoticons4, libnepomukquery4a, kdelibs-bin, libkhtml5, libnepomuk4