[CVE] Insecure handling of arguments in helpers
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| kauth (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| Bionic |
New
|
Undecided
|
Unassigned | ||
| Cosmic |
New
|
Undecided
|
Unassigned | ||
| Disco |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
KDE Project Security Advisory
=======
Title: kauth: Insecure handling of arguments in helpers
Risk Rating: Medium
CVE: CVE-2019-7443
Versions: KDE Frameworks < 5.55.0
Date: 9 February 2019
Overview
========
KAuth allows to pass parameters with arbitrary types to helpers running as root
over DBus. Certain types can cause crashes and trigger decoding arbitrary
images with dynamically loaded plugins.
Solution
========
Update to kauth >= 5.55.0
Or apply the following patch to kauth:
https:/
Credits
=======
Thanks to Fabian Vogt for the report and Albert Astals Cid for the fix.
Debian advisory: https:/
CVE References
| Launchpad Janitor (janitor) wrote | #1 |
| Changed in kauth (Ubuntu Disco): | |
| status: | New → Fix Released |
This bug was fixed in the package kauth - 5.54.0-2ubuntu1
---------------
kauth (5.54.0-2ubuntu1) disco; urgency=medium
* Merge from Debian Unstable. Remaining changes:
- Kubuntu Vcs fields.
- Breaks/Replaces to suit Kubuntu version history.
- Correct errors in long description for libkf5auth-dev-bin
- Pass -fno-keep-
- Keep our symbols file.
* Fixes CVE-2019-7443 (LP: #1815427)
-- Rik Mills <email address hidden> Mon, 11 Feb 2019 10:04:00 +0000