A vulnerability has been found in KTextEditor where local code can be executed without user interaction.

Announced

2024-01-15

Revised

2024-01-15

Access

remote

Bugs

#832447

Advisory

https://security.gentoo.org/glsa/202401-21

Affected packages

Package	Arch	Vulnerable	Unaffected
kde-frameworks/ktexteditor	*	< 5.90.0-r2	>= 5.90.0-r2

Background

Framework providing a full text editor component for KDE.

Description

A vulnerability has been discovered in KTextEditor. Please review the CVE identifiers referenced below for details.

Impact

KTextEditor executes binaries without user interaction in a few cases, e.g. KTextEditor will try to check on external file modification via invoking the "git" binary if the file is known in the repository with the new content.

Workaround

There is no known workaround at this time.

Resolution

All KTextEditor users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-frameworks/ktexteditor-5.90.0-r2"

References

• CVE-2022-23853