USN-4100-1: KConfig and KDE libraries vulnerabilities
16 August 2019
KConfig and KDE libraries could be made to crash or run programs if it opened a specially crafted file.
It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)
It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.
- USN-3042-1: libkrossui4, libkrosscore4, libkdesu5, libkidletime4, libkunitconversion4, libsolid4, libkmediaplayer4, kdelibs5-data, libkde3support4, libknewstuff3-4, libkdecore5, libnepomukutils4, libkdeclarative5, libkhtml5, libktexteditor4, libthreadweaver4, libnepomuk4, libkdeui5, libkprintutils4, libkdnssd4, libkutils4, libkjsembed4, libkpty4, libknewstuff2-4, libkparts4, libkfile4, kdelibs5-dev, kde4libs, libknotifyconfig4, libkntlm4, kdelibs5-plugins, libnepomukquery4a, libplasma3, libkio5, libkimproxy4, libkdewebkit5, libkemoticons4, libkjsapi4, kdoctools, kdelibs-bin, libkcmutils4