chunkcounter.cpp in KTorrent prior to 2.1.2 allows remote malicious users to cause a denial of service (crash) and heap corruption via a negative or large idx value.
Bryan Burns of Juniper Networks discovered that KTorrent did not
correctly validate the destination file paths nor the HAVE statements
sent by torrent peers A malicious remote peer could send specially
crafted messages to overwrite files or execute arbitrary code with user
privileges ...
Debian Bug report logs -
#414832
ktorrent: security vulnerabilities fixed in newer upstream
Package:
ktorrent;
Maintainer for ktorrent is Debian KDE Extras Team <pkg-kde-extras@listsaliothdebianorg>; Source for ktorrent is src:ktorrent (PTS, buildd, popcon)
Reported by: Florian Ernst <florian_ernst@gmxnet>
Date: ...
Vulmon