USN-4100-1: KConfig and KDE libraries vulnerabilities

Releases

• Ubuntu 19.04
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• kconfig - configuration settings framework for Qt
• kde4libs - KDE 4 core applications and libraries

Details

It was discovered that KConfig and KDE libraries have a vulnerability
where an attacker could hide malicious code under desktop and
configuration files. (CVE-2019-14744)

It was discovered that KConfig allows remote attackers to write to
arbitrary files via a ../ in a filename in an archive file. (CVE-2016-6232)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04

• libkdecore5 - 4:4.14.38-0ubuntu6.1
• libkf5configcore5 - 5.56.0-0ubuntu1.1

Ubuntu 18.04

• libkdecore5 - 4:4.14.38-0ubuntu3.1
• libkf5configcore5 - 5.44.0-0ubuntu1.1

Ubuntu 16.04

• libkdecore5 - 4:4.14.16-0ubuntu3.3
• libkf5configcore5 - 5.18.0-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2016-6232
• CVE-2019-14744

Related notices

• USN-3042-1: libnepomukquery4a, libknewstuff3-4, kdelibs5-data, libkdeclarative5, libkdecore5, kdoctools, libkfile4, libkpty4, libkemoticons4, libkmediaplayer4, libkidletime4, libkrossui4, libkrosscore4, libktexteditor4, libplasma3, libnepomukutils4, kdelibs-bin, libkio5, libkhtml5, libkntlm4, kdelibs5-dev, libkcmutils4, libkdesu5, libkutils4, libkjsapi4, libknotifyconfig4, kde4libs, libknewstuff2-4, libnepomuk4, libkprintutils4, libkdewebkit5, libkimproxy4, libthreadweaver4, libsolid4, libkdnssd4, libkparts4, kdelibs5-plugins, libkde3support4, libkdeui5, libkjsembed4, libkunitconversion4