USN-4100-1: KConfig and KDE libraries vulnerabilities

kconfig, kde4libs vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 19.04
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS

Summary

KConfig and KDE libraries could be made to crash or run programs if it
opened a specially crafted file.

Software Description

kconfig – configuration settings framework for Qt
kde4libs – KDE 4 core applications and libraries

Details

It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)

It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04: libkdecore5 – 4:4.14.38-0ubuntu6.1; libkf5configcore5 – 5.56.0-0ubuntu1.1
Ubuntu 18.04 LTS: libkdecore5 – 4:4.14.38-0ubuntu3.1; libkf5configcore5 – 5.44.0-0ubuntu1.1
Ubuntu 16.04 LTS: libkdecore5 – 4:4.14.16-0ubuntu3.3; libkf5configcore5 – 5.18.0-0ubuntu1.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

Source: USN-4100-1: KConfig and KDE libraries vulnerabilities

지락문화예술공작단