Summary
It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)
It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | kconfig | 5.18.0-0ubuntu1.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | kde4libs | 4:4.14.16-0ubuntu3.3 |
| Ubuntu · 18.04 LTS 18.04:LTS | kconfig | 5.44.0-0ubuntu1.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | kde4libs | 4:4.14.38-0ubuntu3.1 |
Vulnerabilities 2
-
Unscored —
Directory traversal vulnerability in KArchive before 5.24, as used in KDE Frameworks, allows remote attackers to write …
-
Unscored —
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with mi…