Ubuntu alert USN-4100-1 (kconfig, kde4libs)
| From: | Paulo Flabiano Smorigo <pfsmorigo@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-4100-1] KConfig and KDE libraries vulnerabilities | |
| Date: | Mon, 19 Aug 2019 10:46:43 -0300 | |
| Message-ID: | <20190819134643.znzn7e7j5n4hpg65@dublin> |
========================================================================== Ubuntu Security Notice USN-4100-1 August 16, 2019 kconfig, kde4libs vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.04 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: KConfig and KDE libraries could be made to crash or run programs if it opened a specially crafted file. Software Description: - kconfig: configuration settings framework for Qt - kde4libs: KDE 4 core applications and libraries Details: It was discovered that KConfig and KDE libraries have a vulnerability where an attacker could hide malicious code under desktop and configuration files. (CVE-2019-14744) It was discovered that KConfig allows remote attackers to write to arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04: libkdecore5 4:4.14.38-0ubuntu6.1 libkf5configcore5 5.56.0-0ubuntu1.1 Ubuntu 18.04 LTS: libkdecore5 4:4.14.38-0ubuntu3.1 libkf5configcore5 5.44.0-0ubuntu1.1 Ubuntu 16.04 LTS: libkdecore5 4:4.14.16-0ubuntu3.3 libkf5configcore5 5.18.0-0ubuntu1.1 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4100-1 CVE-2016-6232, CVE-2019-14744 Package Information: https://launchpad.net/ubuntu/+source/kconfig/5.56.0-0ubun... https://launchpad.net/ubuntu/+source/kde4libs/4:4.14.38-0... https://launchpad.net/ubuntu/+source/kconfig/5.44.0-0ubun... https://launchpad.net/ubuntu/+source/kde4libs/4:4.14.38-0... https://launchpad.net/ubuntu/+source/kconfig/5.18.0-0ubun... https://launchpad.net/ubuntu/+source/kde4libs/4:4.14.16-0... -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...