CVE-2018-6791

An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE
Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or
$() in its volume label is plugged in and mounted through the device
notifier, it’s interpreted as a shell command, leading to a possibility of
arbitrary command execution. An example of an offending volume label is
“$(touch b)” – this will create a file called b in the home folder.

Bugs

• <https://bugs.kde.org/show_bug.cgi?id=389815&gt;
• <https://bugs.launchpad.net/ubuntu/+source/plasma-workspace/+bug/1748247&gt;