MDKSA-2003:004-1
- Package name
- kde
- Date
- 2003-01-17
- Advisory ID
- MDKSA-2003:004-1
- Affected versions
- 9.0 i586
Problem description
Multiple instances of improperly quoted shell command execution exist in KDE 2.x up to and including KDE 3.0.5. KDE fails to properly quote parameters of instructions passed to the shell for execution. These parameters may contain data such as filenames, URLs, email address, and so forth; this data may be provided remotely to a victim via email, web pages, files on a network filesystem, or other untrusted sources. It is possible for arbitrary command execution on a vulnerable system with the privileges of the victim's account. The code audit by the KDE team resulted in patches for KDE 2.2.2 and KDE 3; version 3.0.5a was released and the KDE team encourages the upgrade. The listed KDE2 packages have the KDE team's patches applied to provide the fixed code. Update: The SRPM for the new arts for Mandrake Linux 9.0 was not linked into the updates tree. This has been corrected.
Updated packages
9.0 i586
986c49079443dc8e2af19711344b593f 9.0/RPMS/arts-1.0.5a-1.1mdk.i586.rpm f11b76e016fa9be884669ae52d3b63e3 9.0/RPMS/libarts-1.0.5a-1.1mdk.i586.rpm 8a3a74f1efa3db8b45dc407843dab9fe 9.0/RPMS/libarts-devel-1.0.5a-1.1mdk.i586.rpm 6ff57c1e60e807159641980b488844e4 9.0/RPMS/kdeaddons-3.0.5a-1.1mdk.i586.rpm c11117c522a2ee93eb65a7148e9bab1f 9.0/RPMS/kdeadmin-3.0.5a-1.1mdk.i586.rpm 2f5ff65d792fc990a4ad1ed68917e14f 9.0/RPMS/kdeartwork-3.0.5a-1.1mdk.i586.rpm 683b4f7a5e21c9f38a3e26673b015220 9.0/RPMS/kdebase-3.0.5a-1.1mdk.i586.rpm bc868ecd8eaa7295b306403fe276ab08 9.0/RPMS/kdebase-devel-3.0.5a-1.1mdk.i586.rpm fa1ae8d71cbc85c4014aa08952f4fd82 9.0/RPMS/kdebase-nsplugins-3.0.5a-1.1mdk.i586.rpm b1805dc50560abaeb4bf0bfdbb01f11f 9.0/RPMS/kdeedu-3.0.5a-1.1mdk.i586.rpm d87ea7f14dfdb7f381eb626fe6beaf8a 9.0/RPMS/kdegames-3.0.5a-1.1mdk.i586.rpm 50a0c05ce300ec972d0e0470c58c38df 9.0/RPMS/kdegames-devel-3.0.5a-1.1mdk.i586.rpm 85f330baea22ad3f2f3814f8213d41af 9.0/RPMS/kdegraphics-3.0.5a-1.1mdk.i586.rpm 70461c46833c835c39cd365be55e7972 9.0/RPMS/kdegraphics-devel-3.0.5a-1.1mdk.i586.rpm 224606fb327a15122d5038dc236cdc87 9.0/RPMS/kdelibs-3.0.5a-1.1mdk.i586.rpm 60d9280e57fc456b96a170be883479fb 9.0/RPMS/kdelibs-devel-3.0.5a-1.1mdk.i586.rpm a8057a34803a44b4b6a62e93847b99ac 9.0/RPMS/kdemultimedia-3.0.5a-1.1mdk.i586.rpm 6c6454eda7ac6c2562e8fadd1f147b13 9.0/RPMS/kdemultimedia-aktion-3.0.5a-1.1mdk.i586.rpm 02a724252603be4f10b0d3efded3e366 9.0/RPMS/kdemultimedia-devel-3.0.5a-1.1mdk.i586.rpm c1f5dc68f875461660e1fe7d84acfd6e 9.0/RPMS/kdenetwork-3.0.5a-1.1mdk.i586.rpm cd46ffdba31e6a0e63fd9a8dd89abb7f 9.0/RPMS/kdenetwork-devel-3.0.5a-1.1mdk.i586.rpm df615dab4a0a3ea4a90f15891990428d 9.0/RPMS/kdepim-3.0.5a-1.1mdk.i586.rpm 940761f11616e9c02d9245a6a6b206c2 9.0/RPMS/kdepim-devel-3.0.5a-1.1mdk.i586.rpm 9424ac994d49fcfde26662aa1cfbc9ea 9.0/RPMS/kdesdk-3.0.5a-1.1mdk.i586.rpm 8adfe2f54b43417b740b2fa61d4af7cb 9.0/RPMS/kdesdk-devel-3.0.5a-1.1mdk.i586.rpm 9e505cf4ed806a82056193339faacf82 9.0/RPMS/kdetoys-3.0.5a-1.1mdk.i586.rpm e1b6269ddc2aaed82261fd2828afba3e 9.0/RPMS/kdetoys-devel-3.0.5a-1.1mdk.i586.rpm 042fc90eafa26d333d239bcb78522801 9.0/RPMS/kdeutils-3.0.5a-1.1mdk.i586.rpm 68a2e42f3c53486e5d0ccb128c5067fc 9.0/RPMS/kdeutils-devel-3.0.5a-1.1mdk.i586.rpm 50313422b55542104f50c7f0563d9207 9.0/SRPMS/arts-1.0.5a-1.1mdk.src.rpm 699a3617dc6eb311870ab57dbe33d346 9.0/SRPMS/kdeaddons-3.0.5a-1.1mdk.src.rpm d3d371eefd39808851087b175130afb0 9.0/SRPMS/kdeadmin-3.0.5a-1.1mdk.src.rpm a8995b62179fe4f34eca3e75ff6c560d 9.0/SRPMS/kdeartwork-3.0.5a-1.1mdk.src.rpm 7c366763f85e45f851b93f99e98647c0 9.0/SRPMS/kdebase-3.0.5a-1.1mdk.src.rpm 09e552de4fb81bde9f80164c029d9c5b 9.0/SRPMS/kdeedu-3.0.5a-1.1mdk.src.rpm 8b2b9d3ef05e3a86655c43e52dbbce5d 9.0/SRPMS/kdegames-3.0.5a-1.1mdk.src.rpm cfb27d615fcead15514897ae65c050d5 9.0/SRPMS/kdegraphics-3.0.5a-1.1mdk.src.rpm 5887376b695d9b729d64b03c41c5c49b 9.0/SRPMS/kdelibs-3.0.5a-1.1mdk.src.rpm 492ae0b53d16f9895f0a3354c4948ecf 9.0/SRPMS/kdemultimedia-3.0.5a-1.1mdk.src.rpm efaa67237243791047086351bf6442eb 9.0/SRPMS/kdenetwork-3.0.5a-1.1mdk.src.rpm d016d02b48f1b345a8007d5e32da809e 9.0/SRPMS/kdepim-3.0.5a-1.1mdk.src.rpm 045e103a704d03caf3f26a55eea1df3a 9.0/SRPMS/kdesdk-3.0.5a-1.1mdk.src.rpm a66af52a08a09d10b655a53368dc4ed8 9.0/SRPMS/kdetoys-3.0.5a-1.1mdk.src.rpm a5f36ea2c7fb97e7212a58560098ea42 9.0/SRPMS/kdeutils-3.0.5a-1.1mdk.src.rpm