Arch Linux alert ASA-202506-5 (konsole)
| From: | Andrea Denisse <denisse@archlinux.org> | |
| To: | arch-security <arch-security@lists.archlinux.org> | |
| Subject: | [ASA-202506-5] konsole: arbitrary code execution | |
| Date: | Fri, 13 Jun 2025 14:33:10 -0600 | |
| Message-ID: | <5ecd4b2c1c7818349be9dd1c69492f0efc52028f.camel@archlinux.org> | |
| Archive-link: | Article |
Arch Linux Security Advisory ASA-202506-5 ========================================= Severity: High Date : 2025-06-11 CVE-ID : CVE-2025-49091 Package : konsole Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2897 Summary ======= The package konsole before version 25.04.2-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 25.04.2-1. # pacman -Syu "konsole>=25.04.2-1" The problem has been fixed upstream in version 25.04.2. Workaround ========== None. Description =========== Konsole supports loading URLs from the scheme handlers such as telnet://URL. This can be executed regardless of whether the telnet binary is available. In this mode konsole had a path where if telnet was not available it would fall back to using bash for the given arguments provided; which is the URL provided. This allows an attacker to execute arbitrary code. Browsers typically provide a prompt when a user opens an external scheme handler which would look suspicious, requiring user interaction to be exploitable. Impact ====== A remote attacker can trick a user into opening a specially crafted URL that exploits Konsole’s scheme handler fallback mechanism, leading to arbitrary code execution. References ========== https://kde.org/info/security/advisory-20250609-1.txt https://proofnet.de/publikationen/konsole_rce.html https://nvd.nist.gov/vuln/detail/CVE-2025-49091 https://www.openwall.com/lists/oss-security/2025/06/10/5 https://invent.kde.org/utilities/konsole/-/commit/09d20de... https://security.archlinux.org/CVE-2025-49091