Vulnerability in kde4libs - security update
Summary
DLA-570-1: kde4libs - security update. Affects kde4libs versions < 4:4.8.4-4+deb7u2. Fixed in 4:4.8.4-4+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
kde4libs is a package in the Debian 7 Wheezy ecosystem that provides libraries and core functionality for KDE applications. It is responsible for handling file extraction from tar files. However, a vulnerability was discovered in the KArchiveDirectory::copyTo() function, which allowed an attacker to trick the function into extracting files to arbitrary system locations from a specially prepared tar file outside of the extraction folder.
Vulnerability Detail
The vulnerability in kde4libs allowed an attacker to manipulate the file extraction process and extract files to unintended system locations. This could potentially lead to arbitrary code execution or privilege escalation if the extracted files were executed with elevated privileges. The issue was fixed in version 4:4.8.4-4+deb7u2 of kde4libs.
How To Fix
Minimum fixed version
4:4.8.4-4+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kde4libsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the vulnerability in kde4libs allowed for arbitrary file extraction to system locations. It is crucial to upgrade to the fixed version of kde4libs to mitigate the risk of arbitrary code execution or privilege escalation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kde4libs →
FAQ
kde4libs is a package in the Debian 7 Wheezy ecosystem that provides libraries and core functionality for KDE applications.
The vulnerability allowed an attacker to extract files to arbitrary system locations, potentially leading to arbitrary code execution or privilege escalation.
Yes, the vulnerability has been fixed in version 4:4.8.4-4+deb7u2 of kde4libs.
To fix the vulnerability, it is recommended to upgrade the kde4libs package to version 4:4.8.4-4+deb7u2 or later.
More information about Debian LTS security advisories can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for kde4libs.
