Opened 4 years ago

Closed 4 years ago

Last modified 4 years ago

#13217 closed enhancement (fixed)

kf5-apps kwave kate 19.12.3 (Hold until May)

Reported by: Bruce Dubbs Owned by: Bruce Dubbs
Priority: normal Milestone: 10.0
Component: BOOK Version: SVN
Severity: normal Keywords:
Cc:

Description

New minor version.

Change History (7)

comment:1 by Bruce Dubbs, 4 years ago

Summary: kf5-apps kwave kate 19,12,3 (Hold until May)kf5-apps kwave kate 19.12.3 (Hold until May)

comment:2 by Douglas R. Reno, 4 years ago

Okular seems to have a security fix for executing local binaries using PDF files (CVE-2020-9359). It's not high enough risk to really need any urgent fixes though IMO:


KDE Project Security Advisory
=============================

Title:          Okular: Local binary execution via action links
Risk Rating:    Low
CVE:            CVE-2020-9359
Versions:       Okular < 1.10.0 (tarball name okular-20.04.0.tar.xz)
Date:           12th March 2019


Overview
========
Okular can be tricked into executing local binaries via specially crafted
PDF files.

This binary execution can require almost no user interaction.

No parameters can be passed to those local binaries.

We have not been able to identify any binary that will cause actual damage,
be it in the hardware or software level, when run without parameters.

We remain relatively confident that for this issue to do any actual damage,
it has to run a binary specially crafted. That binary must have been deployed
to the user system via another method, be it the user downloading it directly
as an email attachment, webpage download, etc. or by the system being already
compromised.


Solution
========
- Update to Okular >= 1.10.0
- or apply the following patch:
https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244


Workaround
==========
There's no real workaround other than not opening PDF files from untrusted sources.


Credits
=======
Thanks to Mickael Karatekin from Sysdream Labs for the discovery and to
Albert Astals Cid for the fix.

comment:3 by Bruce Dubbs, 4 years ago

Milestone: hold9.2
Owner: changed from blfs-book to Bruce Dubbs

comment:4 by Bruce Dubbs, 4 years ago

Status: newassigned

comment:5 by Bruce Dubbs, 4 years ago

Resolution: fixed
Status: assignedclosed

Fixed at revision 23142.

comment:6 by Bruce Dubbs, 4 years ago

Milestone: 9.210,0

Milestone renamed

comment:7 by Bruce Dubbs, 4 years ago

Milestone: 10,010.0

Milestone renamed

Note: See TracTickets for help on using tickets.