Bug 13545 - kdelibs4 new security issue CVE-2014-3494
Summary: kdelibs4 new security issue CVE-2014-3494
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Nicolas Lécureuil
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/604032/
Whiteboard:
Keywords:
Depends on: 13221
Blocks:
  Show dependency tree / graph
 
Reported: 2014-06-18 22:14 CEST by David Walser
Modified: 2014-10-29 13:29 CET (History)
2 users (show)

See Also:
Source RPM: kdelibs4-4.13.2-1.mga5.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2014-06-18 22:14:29 CEST 
KDE has issued an advisory today (June 18):
http://openwall.com/lists/oss-security/2014/06/18/16

The issue is fixed upstream in 4.13.3, and the commit is linked in the message above.

Mageia 4 is also affected; Mageia 3 is not.

Reproducible: 

Steps to Reproduce:
David Walser 2014-06-18 22:14:46 CEST

CC: (none) => balcaen.john, lmenut
Whiteboard: (none) => MGA4TOO

Comment 1 Luc Menut 2014-06-26 22:02:39 CEST 
upstream patch applied in kdelibs4-4.13.2-2 for cauldron.

Hardware: i586 => All
Blocks: (none) => 13221

Comment 2 David Walser 2014-06-26 22:18:52 CEST 
Thanks Luc!  Setting version to 4 now that kdelibs4-4.13.2-2.mga5 is built.

We can use Bug 13221 for submitting the update to QA (along with the rest of KDE), so I'll switch that one to be the blocker.

Depends on: (none) => 13221
Blocks: 13221 => (none)

David Walser 2014-06-26 22:18:59 CEST

Version: Cauldron => 4
Whiteboard: MGA4TOO => (none)

Comment 3 David Walser 2014-07-01 18:52:10 CEST 
Fedora has issued an advisory for this on June 21:
https://lists.fedoraproject.org/pipermail/package-announce/2014-July/134961.html

For reference, here's the upstream URL for their advisory:
http://www.kde.org/info/security/advisory-20140618-1.txt

URL: (none) => http://lwn.net/Vulnerabilities/604032/

Comment 4 Luc Menut 2014-10-29 13:29:03 CET 
Fixed in KDE 4.12.5

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.