[Bug 1839432] Re: [CVE] malicious .desktop files (and others) would execute code

[Launchpad Bug Tracker]

This bug was fixed in the package kde4libs - 4:4.14.38-0ubuntu6.1

---------------
kde4libs (4:4.14.38-0ubuntu6.1) disco-security; urgency=medium

  * SECURITY UPDATE: malicious .desktop files (and others) would execute
    code (LP: #1839432).
    - debian/patches/CVE-2019-14744.patch: remove support for $(...) in
      config keys with [$e] marker.
    - debian/patches/kdelibs-4.14.38-openssl-1.1.patch: Make kssl compile
      against OpenSSL 1.1.0
    - CVE-2019-14744

 -- Paulo Flabiano Smorigo <pfsmorigo at canonical.com>  Mon, 12 Aug 2019
10:53:32 -0300

** Changed in: kde4libs (Ubuntu Disco)
       Status: New => Fix Released

** Changed in: kde4libs (Ubuntu Xenial)
       Status: New => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6232

-- 
You received this bug notification because you are a member of Kubuntu
Bugs, which is subscribed to kde4libs in Ubuntu.
https://bugs.launchpad.net/bugs/1839432

Title:
  [CVE] malicious .desktop files (and others) would execute code

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/kconfig/+bug/1839432/+subscriptions