Hi,
According to my analysis only recent versions should be affected:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7f8624b3c13f84e0233f8f893bce99090a7dd3a2
The tracker was updated to mark Debian non-affected:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f0cddbc1a89d6988e0891225dfe9eb40374b1d8d
I'm leaving the bug open but feel free to close it if the above sounds
sensible :)
Cheers!
Sylvain Beucler
Debian LTS Team
On Fri, 16 Feb 2024 16:16:09 +0100 =?UTF-8?Q?Moritz_M=C3=BChlenhoff?=
<j...@inutil.org> wrote:
Source: plasma-workspace
X-Debbugs-CC: t...@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for plasma-workspace.
CVE-2024-1433[0]:
| A vulnerability, which was classified as problematic, was found in
| KDE Plasma Workspace up to 5.93.0. This affects the function
| EventPluginsManager::enabledPlugins of the file
| components/calendar/eventpluginsmanager.cpp of the component Theme
| File Handler. The manipulation of the argument pluginId leads to
| path traversal. It is possible to initiate the attack remotely. The
| complexity of an attack is rather high. The exploitability is told
| to be difficult. The patch is named
| 6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01. It is recommended to apply
| a patch to fix this issue. The associated identifier of this
| vulnerability is VDB-253407. NOTE: This requires write access to
| user's home or the installation of third party global themes.
https://github.com/KDE/plasma-workspace/commit/6cdf42916369ebf4ad5bd876c4dfa0170d7b2f01
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-1433
https://www.cve.org/CVERecord?id=CVE-2024-1433
Please adjust the affected versions in the BTS as needed.
