It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied on this method to handle user input.
USN-8857-1: KCoreAddons vulnerability
About this summary. This is a short excerpt from the description that Ubuntu Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://ubuntu.com/security/notices/USN-8857-1
Source attribution: headline and facts are from Ubuntu Security (ubuntu.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
USN-8957-1: authd vulnerability
Ali Mashally discovered that authd did not properly validate user identities when matching accounts from identity providers. An attacker could possibly use this issue to…
USN-8956-1: Brotli vulnerability
It was discovered that Brotli incorrectly handled certain compressed streams. A remote attacker could possibly use this issue to cause a denial of service or execute…
USN-8954-1: zlib vulnerability
Ali Firas discovered that zlib incorrectly handled certain non-blocking write operations. An attacker could possibly use this issue to trigger a heap buffer overflow…
USN-8953-1: OpenVPN vulnerability
It was discovered that OpenVPN incorrectly handled certificate subject fields. A remote authenticated user could possibly use this issue to impersonate other users.
USN-8950-1: poppler vulnerability
It was discovered that poppler incorrectly handled the password length limit when decrypting certain encrypted PDF files. An attacker could possibly use this issue to…
USN-8945-1: XZ Utils vulnerability
It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker…