Nom du paquet
kde
Date
2003-01-17
Advisory ID
MDKSA-2003:004-1
Affected versions
9.0 i586

Problem description

Multiple instances of improperly quoted shell command execution exist in KDE 2.x up to and including KDE 3.0.5. KDE fails to properly quote parameters of instructions passed to the shell for execution. These parameters may contain data such as filenames, URLs, email address, and so forth; this data may be provided remotely to a victim via email, web pages, files on a network filesystem, or other untrusted sources. It is possible for arbitrary command execution on a vulnerable system with the privileges of the victim's account. The code audit by the KDE team resulted in patches for KDE 2.2.2 and KDE 3; version 3.0.5a was released and the KDE team encourages the upgrade. The listed KDE2 packages have the KDE team's patches applied to provide the fixed code. Update: The SRPM for the new arts for Mandrake Linux 9.0 was not linked into the updates tree. This has been corrected.

Updated packages

9.0 i586

 986c49079443dc8e2af19711344b593f  9.0/RPMS/arts-1.0.5a-1.1mdk.i586.rpm
f11b76e016fa9be884669ae52d3b63e3  9.0/RPMS/libarts-1.0.5a-1.1mdk.i586.rpm
8a3a74f1efa3db8b45dc407843dab9fe  9.0/RPMS/libarts-devel-1.0.5a-1.1mdk.i586.rpm
6ff57c1e60e807159641980b488844e4  9.0/RPMS/kdeaddons-3.0.5a-1.1mdk.i586.rpm
c11117c522a2ee93eb65a7148e9bab1f  9.0/RPMS/kdeadmin-3.0.5a-1.1mdk.i586.rpm
2f5ff65d792fc990a4ad1ed68917e14f  9.0/RPMS/kdeartwork-3.0.5a-1.1mdk.i586.rpm
683b4f7a5e21c9f38a3e26673b015220  9.0/RPMS/kdebase-3.0.5a-1.1mdk.i586.rpm
bc868ecd8eaa7295b306403fe276ab08  9.0/RPMS/kdebase-devel-3.0.5a-1.1mdk.i586.rpm
fa1ae8d71cbc85c4014aa08952f4fd82  9.0/RPMS/kdebase-nsplugins-3.0.5a-1.1mdk.i586.rpm
b1805dc50560abaeb4bf0bfdbb01f11f  9.0/RPMS/kdeedu-3.0.5a-1.1mdk.i586.rpm
d87ea7f14dfdb7f381eb626fe6beaf8a  9.0/RPMS/kdegames-3.0.5a-1.1mdk.i586.rpm
50a0c05ce300ec972d0e0470c58c38df  9.0/RPMS/kdegames-devel-3.0.5a-1.1mdk.i586.rpm
85f330baea22ad3f2f3814f8213d41af  9.0/RPMS/kdegraphics-3.0.5a-1.1mdk.i586.rpm
70461c46833c835c39cd365be55e7972  9.0/RPMS/kdegraphics-devel-3.0.5a-1.1mdk.i586.rpm
224606fb327a15122d5038dc236cdc87  9.0/RPMS/kdelibs-3.0.5a-1.1mdk.i586.rpm
60d9280e57fc456b96a170be883479fb  9.0/RPMS/kdelibs-devel-3.0.5a-1.1mdk.i586.rpm
a8057a34803a44b4b6a62e93847b99ac  9.0/RPMS/kdemultimedia-3.0.5a-1.1mdk.i586.rpm
6c6454eda7ac6c2562e8fadd1f147b13  9.0/RPMS/kdemultimedia-aktion-3.0.5a-1.1mdk.i586.rpm
02a724252603be4f10b0d3efded3e366  9.0/RPMS/kdemultimedia-devel-3.0.5a-1.1mdk.i586.rpm
c1f5dc68f875461660e1fe7d84acfd6e  9.0/RPMS/kdenetwork-3.0.5a-1.1mdk.i586.rpm
cd46ffdba31e6a0e63fd9a8dd89abb7f  9.0/RPMS/kdenetwork-devel-3.0.5a-1.1mdk.i586.rpm
df615dab4a0a3ea4a90f15891990428d  9.0/RPMS/kdepim-3.0.5a-1.1mdk.i586.rpm
940761f11616e9c02d9245a6a6b206c2  9.0/RPMS/kdepim-devel-3.0.5a-1.1mdk.i586.rpm
9424ac994d49fcfde26662aa1cfbc9ea  9.0/RPMS/kdesdk-3.0.5a-1.1mdk.i586.rpm
8adfe2f54b43417b740b2fa61d4af7cb  9.0/RPMS/kdesdk-devel-3.0.5a-1.1mdk.i586.rpm
9e505cf4ed806a82056193339faacf82  9.0/RPMS/kdetoys-3.0.5a-1.1mdk.i586.rpm
e1b6269ddc2aaed82261fd2828afba3e  9.0/RPMS/kdetoys-devel-3.0.5a-1.1mdk.i586.rpm
042fc90eafa26d333d239bcb78522801  9.0/RPMS/kdeutils-3.0.5a-1.1mdk.i586.rpm
68a2e42f3c53486e5d0ccb128c5067fc  9.0/RPMS/kdeutils-devel-3.0.5a-1.1mdk.i586.rpm
50313422b55542104f50c7f0563d9207  9.0/SRPMS/arts-1.0.5a-1.1mdk.src.rpm
699a3617dc6eb311870ab57dbe33d346  9.0/SRPMS/kdeaddons-3.0.5a-1.1mdk.src.rpm
d3d371eefd39808851087b175130afb0  9.0/SRPMS/kdeadmin-3.0.5a-1.1mdk.src.rpm
a8995b62179fe4f34eca3e75ff6c560d  9.0/SRPMS/kdeartwork-3.0.5a-1.1mdk.src.rpm
7c366763f85e45f851b93f99e98647c0  9.0/SRPMS/kdebase-3.0.5a-1.1mdk.src.rpm
09e552de4fb81bde9f80164c029d9c5b  9.0/SRPMS/kdeedu-3.0.5a-1.1mdk.src.rpm
8b2b9d3ef05e3a86655c43e52dbbce5d  9.0/SRPMS/kdegames-3.0.5a-1.1mdk.src.rpm
cfb27d615fcead15514897ae65c050d5  9.0/SRPMS/kdegraphics-3.0.5a-1.1mdk.src.rpm
5887376b695d9b729d64b03c41c5c49b  9.0/SRPMS/kdelibs-3.0.5a-1.1mdk.src.rpm
492ae0b53d16f9895f0a3354c4948ecf  9.0/SRPMS/kdemultimedia-3.0.5a-1.1mdk.src.rpm
efaa67237243791047086351bf6442eb  9.0/SRPMS/kdenetwork-3.0.5a-1.1mdk.src.rpm
d016d02b48f1b345a8007d5e32da809e  9.0/SRPMS/kdepim-3.0.5a-1.1mdk.src.rpm
045e103a704d03caf3f26a55eea1df3a  9.0/SRPMS/kdesdk-3.0.5a-1.1mdk.src.rpm
a66af52a08a09d10b655a53368dc4ed8  9.0/SRPMS/kdetoys-3.0.5a-1.1mdk.src.rpm
a5f36ea2c7fb97e7212a58560098ea42  9.0/SRPMS/kdeutils-3.0.5a-1.1mdk.src.rpm

References