Bug#1064063: plasma-workspace: CVE-2024-1433
Source: plasma-workspace
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for plasma-workspace.
CVE-2024-1433[0]:
| A vulnerability, which was classified as problematic, was found in
| KDE Plasma Workspace up to 5.93.0. This affects the function
| EventPluginsManager::enabledPlugins of the file
| components/calendar/eventpluginsmanager.cpp of the component Theme
| File Handler. The manipulation of the argument pluginId leads to
| path traversal. It is possible to initiate the attack remotely. The
| complexity of an attack is rather high. The exploitability is told
| to be difficult. The patch is named
| 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply
| a patch to fix this issue. The associated identifier of this
| vulnerability is VDB-253407. NOTE: This requires write access to
| user's home or the installation of third party global themes.
https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-1433
https://www.cve.org/CVERecord?id=CVE-2024-1433
Please adjust the affected versions in the BTS as needed.
Reply to: