Package : kdelibs Version : 3.5.10.dfsg.1-5+deb6u1 CVE ID : CVE-2015-7543 It has been reported that kdelibs uses the insecure mktemp() function to create the temporary directory it uses to host user-specific sockets. It is thus possible for another user to hijack this temporary directory and gain socket accesses it should not have. In Debian 6 “Squeeze”, this issue has been addressed in kdelibs 3.5.10.dfsg.1-5+deb6u1 with the use of the safer mkdtemp() function. We recommend that you upgrade your kdelibs packages. Other Debian releases have newer versions of the libraries (kdelibs4) that are not affected by this problem. -- Raphaël Hertzog ◈ Debian Developer Support Debian LTS: http://www.freexian.com/services/debian-lts.html Learn to master Debian: http://debian-handbook.info/get/
Attachment:
signature.asc
Description: PGP signature