==========================================================================
Ubuntu Security Notice USN-4100-1
August 16, 2019

kconfig, kde4libs vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.04
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

KConfig and KDE libraries could be made to crash or run programs if it
opened a specially crafted file.

Software Description:
– kconfig: configuration settings framework for Qt
– kde4libs: KDE 4 core applications and libraries

Details:

It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)

It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
libkdecore5 4:4.14.38-0ubuntu6.1
libkf5configcore5 5.56.0-0ubuntu1.1

Ubuntu 18.04 LTS:
libkdecore5 4:4.14.38-0ubuntu3.1
libkf5configcore5 5.44.0-0ubuntu1.1

Ubuntu 16.04 LTS:
libkdecore5 4:4.14.16-0ubuntu3.3
libkf5configcore5 5.18.0-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4100-1
CVE-2016-6232, CVE-2019-14744

Package Information:
https://launchpad.net/ubuntu/+source/kconfig/5.56.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/kde4libs/4:4.14.38-0ubuntu6.1
https://launchpad.net/ubuntu/+source/kconfig/5.44.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/kde4libs/4:4.14.38-0ubuntu3.1
https://launchpad.net/ubuntu/+source/kconfig/5.18.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/kde4libs/4:4.14.16-0ubuntu3.3
—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAl1aqEMACgkQbUp5kL3i
zGYjsw/+IRPgeXA6M3w0j0suh7hWvDHdd4eF3oEt6QMc40KkulR+dxd++oLz/zej
H9NVheaUdtTY++0CACIilZ859kXGEYgFQ085sz8T+oB9RUoRMZwBV5girDu/+EAi
3LmqBQgjqj1p9SkhE3seIA5dMGIObByxqkaGBjRLdtJvxZlXF1xnv3laPFdudv7u
fdroWimTzcDlfNU7p15+TAWd2bS2Tr5mvWG+Vd1lrStx9i0FI7ZHs7WwzwH6HQdZ
axbnJtzc5RsRKuRelyuzA2TEts37Ip4E3v/tMr45dLgZbDc2uu6h9tqmGhGeJgNQ
tQ0P9ZVOup4gcU7S1wI6EJgYFRxgN6NAKFOF5U1Js7TCPLPxGau8Y5GvGNw2I9jE
csevZajQG3VpaVfDDHTPN23wdvyn1CYZP85WpQClHuclsh4Yi4D7DCntVd4kVZOj
K+qD7mWMk3rcVWB2PJNq0YbwMnMXAKe/48GwVzm5RQ7WdAR+y2WznbQ3zVA9tEEV
TnxAyaQuaaRWThq++Nx+tcMa/NvzRwD9ENydCegociqLgoDOqVulDQ4piypvB7A/
HdHQy3KjpFRboYRaebUMNKQchS44b7e2PRvPszbnftmlrG38+vqq9J/oydQNd4LI
izgcTzoEyDp+ecuXaRWUVtsZMgbM3HiuflSSgxeMOoRpdwwZkaY=
=fzuD
—–END PGP SIGNATURE—–
—