Debian Bug report logs -
#1064063
plasma-workspace: CVE-2024-1433
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, team@security.debian.org, Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>:
Bug#1064063; Package src:plasma-workspace.
(Fri, 16 Feb 2024 15:18:06 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Mühlenhoff <jmm@inutil.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>.
(Fri, 16 Feb 2024 15:18:06 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: plasma-workspace
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for plasma-workspace.
CVE-2024-1433[0]:
| A vulnerability, which was classified as problematic, was found in
| KDE Plasma Workspace up to 5.93.0. This affects the function
| EventPluginsManager::enabledPlugins of the file
| components/calendar/eventpluginsmanager.cpp of the component Theme
| File Handler. The manipulation of the argument pluginId leads to
| path traversal. It is possible to initiate the attack remotely. The
| complexity of an attack is rather high. The exploitability is told
| to be difficult. The patch is named
| 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply
| a patch to fix this issue. The associated identifier of this
| vulnerability is VDB-253407. NOTE: This requires write access to
| user's home or the installation of third party global themes.
https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-1433
https://www.cve.org/CVERecord?id=CVE-2024-1433
Please adjust the affected versions in the BTS as needed.
Added tag(s) upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Fri, 16 Feb 2024 20:09:06 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Fri Feb 16 20:46:18 2024;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon