Description
The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | amarok | 1.4.10-1 | — |
| Debian 13 | amarok | 1.4.10-1 | — |
References
- 32357 third-party-advisory
- http://websvn.kde.org/?view=rev&revision=846626
- 31418 third-party-advisory
- MDVSA-2008:172 vendor-advisory
- USN-657-1 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765
- http://amarok.kde.org/en/releases/1/4/10
- FEDORA-2008-7739 vendor-advisory
- ADV-2008-2338 vdb-entry
- 31663 third-party-advisory
- GLSA-200809-08 vendor-advisory
- amarok-magnatunebrowser-symlink(44399) vdb-entry
- SSA:2008-241-01 vendor-advisory
- 30662 vdb-entry
- FEDORA-2008-7719 vendor-advisory
- 31839 third-party-advisory