Debian Security Advisory
DSA-237-1 kdenetwork -- several vulnerabilities
- Date Reported:
- 22 Jan 2003
- Affected Packages:
- kdenetwork
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2002-1393.
- More information:
-
The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be provided remotely to a victim in an e-mail, a webpage or files on a network filesystem or other untrusted source.
By carefully crafting such data an attacker might be able to execute arbitrary commands on a vulnerable system using the victim's account and privileges. The KDE Project is not aware of any existing exploits of these vulnerabilities. The patches also provide better safe guards and check data from untrusted sources more strictly in multiple places.
For the current stable distribution (woody), these problems have been fixed in version 2.2.2-14.6.
The old stable distribution (potato) does not contain KDE packages.
For the unstable distribution (sid), these problems will most probably not be fixed but new packages for KDE 3.1 for sid are expected for this year.
We recommend that you upgrade your KDE packages.
- Fixed in:
-
Debian GNU/Linux 3.0 (woody)
- Source:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2-14.6.dsc
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2-14.6.diff.gz
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2.orig.tar.gz
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2-14.6.diff.gz
- Alpha:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_alpha.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_arm.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_i386.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_ia64.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_hppa.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_m68k.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_mips.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_mipsel.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_powerpc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_s390.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/korn_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kppp_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ksirc_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/ktalkd_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libkdenetwork1_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib-dev_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/libmimelib1_2.2.2-14.6_sparc.deb
- http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.6_sparc.deb
MD5 checksums of the listed files are available in the original advisory.