[SECURITY] [DLA 367-1] kdelibs security update

2015-12-1012:00:57

lists.debian.org

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Package : kdelibs
Version : 3.5.10.dfsg.1-5+deb6u1
CVE ID : CVE-2015-7543

It has been reported that kdelibs uses the insecure mktemp() function
to create the temporary directory it uses to host user-specific sockets.
It is thus possible for another user to hijack this temporary directory
and gain socket accesses it should not have.

In Debian 6 “Squeeze”, this issue has been addressed in kdelibs
3.5.10.dfsg.1-5+deb6u1 with the use of the safer mkdtemp() function.
We recommend that you upgrade your kdelibs packages.

Other Debian releases have newer versions of the libraries (kdelibs4) that
are not affected by this problem.

–
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian6i386libartsc0-dev< 1.5.9-3+deb6u1libartsc0-dev_1.5.9-3+deb6u1_i386.deb
Debian6amd64libarts1c2a< 1.5.9-3+deb6u1libarts1c2a_1.5.9-3+deb6u1_amd64.deb
Debian6amd64libarts1-dev< 1.5.9-3+deb6u1libarts1-dev_1.5.9-3+deb6u1_amd64.deb
Debian6i386arts-dbg< 1.5.9-3+deb6u1arts-dbg_1.5.9-3+deb6u1_i386.deb
Debian6amd64libartsc0-dev< 1.5.9-3+deb6u1libartsc0-dev_1.5.9-3+deb6u1_amd64.deb
Debian6allkdelibs< 3.5.10.dfsg.1-5+deb6u1kdelibs_3.5.10.dfsg.1-5+deb6u1_all.deb
Debian6i386libarts1-dev< 1.5.9-3+deb6u1libarts1-dev_1.5.9-3+deb6u1_i386.deb
Debian6i386libartsc0< 1.5.9-3+deb6u1libartsc0_1.5.9-3+deb6u1_i386.deb
Debian6amd64arts-dbg< 1.5.9-3+deb6u1arts-dbg_1.5.9-3+deb6u1_amd64.deb
Debian6i386libarts1c2a< 1.5.9-3+deb6u1libarts1c2a_1.5.9-3+deb6u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	i386	libartsc0-dev	< 1.5.9-3+deb6u1	libartsc0-dev_1.5.9-3+deb6u1_i386.deb
Debian	6	amd64	libarts1c2a	< 1.5.9-3+deb6u1	libarts1c2a_1.5.9-3+deb6u1_amd64.deb
Debian	6	amd64	libarts1-dev	< 1.5.9-3+deb6u1	libarts1-dev_1.5.9-3+deb6u1_amd64.deb
Debian	6	i386	arts-dbg	< 1.5.9-3+deb6u1	arts-dbg_1.5.9-3+deb6u1_i386.deb
Debian	6	amd64	libartsc0-dev	< 1.5.9-3+deb6u1	libartsc0-dev_1.5.9-3+deb6u1_amd64.deb
Debian	6	all	kdelibs	< 3.5.10.dfsg.1-5+deb6u1	kdelibs_3.5.10.dfsg.1-5+deb6u1_all.deb
Debian	6	i386	libarts1-dev	< 1.5.9-3+deb6u1	libarts1-dev_1.5.9-3+deb6u1_i386.deb
Debian	6	i386	libartsc0	< 1.5.9-3+deb6u1	libartsc0_1.5.9-3+deb6u1_i386.deb
Debian	6	amd64	arts-dbg	< 1.5.9-3+deb6u1	arts-dbg_1.5.9-3+deb6u1_amd64.deb
Debian	6	i386	libarts1c2a	< 1.5.9-3+deb6u1	libarts1c2a_1.5.9-3+deb6u1_i386.deb