Description
KDE 2 and KDE 3.1.1 and earlier 3.x versions allows attackers to execute arbitrary commands via (1) PostScript (PS) or (2) PDF files, related to missing -dPARANOIDSAFER and -dSAFER arguments when using the kghostview Ghostscript viewer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 3
- DSA-296 kdebase - insecure execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-284 kdegraphics - insecure execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-293 kdelibs - insecure execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20030412 [Sorcerer-spells] KDE-SORCERER2003-04-12 mailing-list
- MDKSA-2003:049 vendor-advisory
- CLA-2003:668 vendor-advisory
- DSA-296 vendor-advisory
- http://bugs.kde.org/show_bug.cgi?id=53343
- 20030414 GLSA: kde-2.x (200304-05.1) mailing-list
- CLA-2003:747 vendor-advisory
- http://www.kde.org/info/security/advisory-20030409-1.txt
- RHSA-2003:002 vendor-advisory
- http://bugs.kde.org/show_bug.cgi?id=56808
- 20030410 GLSA: kde-3.x (200304-04) mailing-list
- DSA-284 vendor-advisory
- DSA-293 vendor-advisory
- 20030411 GLSA: kde-2.x (200304-05) mailing-list