Debian Security Advisory
DSA-235-1 kdegraphics -- several vulnerabilities
- Date Reported:
- 22 Jan 2003
- Affected Packages:
- kdegraphics
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2002-1393.
- More information:
-
The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be provided remotely to a victim in an e-mail, a webpage or files on a network filesystem or other untrusted source.
By carefully crafting such data an attacker might be able to execute arbitrary commands on a vulnerable system using the victim's account and privileges. The KDE Project is not aware of any existing exploits of these vulnerabilities. The patches also provide better safe guards and check data from untrusted sources more strictly in multiple places.
For the current stable distribution (woody), these problems have been fixed in version 2.2.2-6.10.
The old stable distribution (potato) does not contain KDE packages.
For the unstable distribution (sid), these problems will most probably not be fixed but new packages for KDE 3.1 for sid are expected for this year.
We recommend that you upgrade your KDE packages.
- Fixed in:
-
Debian GNU/Linux 3.0 (woody)
- Source:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kdegraphics_2.2.2-6.10.dsc
- http://security.debian.org/pool/updates/main/k/kdegraphics/kdegraphics_2.2.2-6.10.diff.gz
- http://security.debian.org/pool/updates/main/k/kdegraphics/kdegraphics_2.2.2.orig.tar.gz
- http://security.debian.org/pool/updates/main/k/kdegraphics/kdegraphics_2.2.2-6.10.diff.gz
- Alpha:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_arm.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_i386.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_mips.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_s390.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/k/kdegraphics/kamera_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kfract_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kghostview_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kiconedit_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kooka_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kpaint_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kruler_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/ksnapshot_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kview_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan-dev_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/libkscan1_2.2.2-6.10_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdegraphics/kcoloredit_2.2.2-6.10_sparc.deb
MD5 checksums of the listed files are available in the original advisory.