[USN-4100-1] KConfig and KDE libraries vulnerabilities

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[USN-4100-1] KConfig and KDE libraries vulnerabilities

Paulo Flabiano Smorigo
Ubuntu Security Notice USN-4100-1
August 16, 2019

kconfig, kde4libs vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS


KConfig and KDE libraries could be made to crash or run programs if it
opened a specially crafted file.

Software Description:
- kconfig: configuration settings framework for Qt
- kde4libs: KDE 4 core applications and libraries


It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)

It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  libkdecore5                     4:4.14.38-0ubuntu6.1
  libkf5configcore5               5.56.0-0ubuntu1.1

Ubuntu 18.04 LTS:
  libkdecore5                     4:4.14.38-0ubuntu3.1
  libkf5configcore5               5.44.0-0ubuntu1.1

Ubuntu 16.04 LTS:
  libkdecore5                     4:4.14.16-0ubuntu3.3
  libkf5configcore5               5.18.0-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

  CVE-2016-6232, CVE-2019-14744

Package Information:

ubuntu-security-announce mailing list
[hidden email]
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

signature.asc (849 bytes) Download Attachment