portage-ng / portage / kde-frameworks / kconfig / 6.31.0
version « ‹ 6.31.0 › »
graphs detail deptree gantt
cli --merge --fetchonly --info
security glsa 1 bugs
legacy emerge pmerge
portage-ng glsa
1 advisory reference kde-frameworks/kconfig · none place version 6.31.0 in a vulnerable range
▸ GLSA 201908-07 KDE KConfig: User-assisted execution of arbitrary code this version unaffected normal remote 2019-08-15

A vulnerablity has been found in KDE KConfig that could allow a remote attacker to execute arbitrary code.

Announced
2019-08-15
Revised
2019-08-15
Access
remote
Bugs
#691858
Advisory
https://security.gentoo.org/glsa/201908-07

Affected packages

PackageArchVulnerableUnaffected
kde-frameworks/kconfig*< 5.60.0-r1>= 5.60.0-r1

Background

Provides an advanced configuration system.

Description

A vulnerability was discovered in KDE KConfig’s handling of .desktop and .directory files.

Impact

An attacker could entice a user to execute a specially crafted .desktop or .directory file possibly resulting in execution of arbitrary code with the privileges of the process.

Workaround

There is no known workaround at this time.

Resolution

All KConfig users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=kde-frameworks/kconfig-5.60.0-r1"

References