--------------------------------------------------------------------------
Debian Security Advisory DSA 242-1                     security@debian.org 
Debian -- Security Information                              Martin Schulze
January 24th, 2003                       Debian -- Debian security FAQ 
--------------------------------------------------------------------------

Package        : kdebase
Vulnerability  : several
Problem-type   : local, remote
Debian-specific: no
CVE Id         : CAN-2002-1393

The KDE team discovered several vulnerabilities in the K Desktop
Environment.  In some instances KDE fails to properly quote parametersof instructions passed to a command shell for execution.  These
parameters may incorporate data such as URLs, filenames and e-mail
addresses, and this data may be provided remotely to a victim in an
e-mail, a webpage or files on a network filesystem or other untrusted
source.

By carefully crafting such data an attacker might be able to execute
arbitary commands on a vulnerable system using the victim's account and
privileges.  The KDE Project is not aware of any existing exploits of
these vulnerabilities.  The patches also provide better safe guards
and check data from untrusted sources more strictly in multiple
places.

For the current stable distribution (woody), these problems have been fixed
in version 2.2.2-14.2.

The old stable distribution (potato) does not contain KDE packages.

For the unstable distribution (sid), these problems will most probably
not be fixed but new packages for KDE 3.1 for sid are expected for
this year.

We recommend that you upgrade your KDE packages.


Upgrade Instructions
--------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
--------------------------------

  Source archives:

      
      Size/MD5 checksum:     1155 1c2f6bce7cc06f7fa556d177ee0d1f8c
      
      Size/MD5 checksum:    64429 c01b3398beac82fe7a91ebf23f76dc44
      
      Size/MD5 checksum: 13035693 3c17b6821bbd05c7e04682c70cb7de8a

  Architecture independent components:

      
      Size/MD5 checksum:  3140290 c3d56e354504de6160ce99e7c32a72d4
      
      Size/MD5 checksum:   961472 157b717319bcc918f160226e7cf27b80

  Alpha architecture:

      
      Size/MD5 checksum:   488248 fa12a97ffda1a308dd9d2b8aabbe3a3a
      
      Size/MD5 checksum:  6991312 0105faf2cfa7ef754405e0889d11ca4b
      
      Size/MD5 checksum:   107402 b6c9731bbbe46af37889cb30312ba88f
      
      Size/MD5 checksum:    48790 13302a13b5656ee42f964570711950a8
      
      Size/MD5 checksum:  1988546 e297c55e00b54bd23659bea7ffd25e6f
      
      Size/MD5 checksum:   435722 71a05c9ee98d6a36ff1bc79571d06612
      
      Size/MD5 checksum:  2228458 0b8d04e160a2c86a18d57121ea880c26
      
      Size/MD5 checksum:   537934 c2f3ccfb077fdd9e0e0e62bda19270e2
      
      Size/MD5 checksum:   482142 bb862e074491d4e4e8a247b93a009de3
      
      Size/MD5 checksum:    45328 b7d43c6ab5c05be3ba783bd4cf21ea41
      
      Size/MD5 checksum:   269834 c95c03e6914fc08a0629f3a69c306ec4

  ARM architecture:

      
      Size/MD5 checksum:   418176 120c1c79fd7e5addb73104ecac014e03
      
      Size/MD5 checksum:  6519720 072c37c220bba66c7ca49ad4684ebbc1
      
      Size/MD5 checksum:    85824 b863022ccb62bcf6c8507403a7cef4a7
      
      Size/MD5 checksum:    47866 a13e51117646d5127d7d8a8536d03aa0
      
      Size/MD5 checksum:  1679988 d92d5c6ea6246c7c04148ded871a72ef
      
      Size/MD5 checksum:   390400 251485955001545cdd230f022e16ef71
      
      Size/MD5 checksum:  1925914 c6f262f5ae4796304d498c5bd565ea6a
      
      Size/MD5 checksum:   456860 08333dfdecf4b47a304000430e73b44e
      
      Size/MD5 checksum:   374834 5acfa19be2dc4f43b0ae9f6b27985627
      
      Size/MD5 checksum:    45336 99a5b5668b5e90af15f9997dea0f4808
      
      Size/MD5 checksum:   215360 65c4d19f324ff5a370acf0294cb7d73d

  Intel IA-32 architecture:

      
      Size/MD5 checksum:   407314 2ce33f8648b83c55f30113d01506cf13
      
      Size/MD5 checksum:  6485854 cc5c871ea43054b6f19157b90c48c06c
      
      Size/MD5 checksum:    83350 bdfae8fd937cc0467bf297403ea448d1
      
      Size/MD5 checksum:    47100 e9f36485f457971f7411266bd7d2614c
      
      Size/MD5 checksum:  1651936 ca733bd1a0e47861d5091c73dada22e2
      
      Size/MD5 checksum:   395278 09d12dc33bb2dab7cf6396ecd6e6bba0
      
      Size/MD5 checksum:  1928578 f46c5020af0388f6a20543eb203b9158
      
      Size/MD5 checksum:   458384 27eeee0d5b9424eb6f57ef3eaf3f467c
      
      Size/MD5 checksum:   395632 cb9dc1d1ed88d2cf16df73a36087c41c
      
      Size/MD5 checksum:    45330 bb8b258083caf8b8456619c6e1b0a9fc
      
      Size/MD5 checksum:   220344 14fea5cf957bb2c4959d2ea4bb397df0

  Intel IA-64 architecture:

      
      Size/MD5 checksum:   611832 fe5f4d19cdcea1f0b378fd2f09630cde
      
      Size/MD5 checksum:  7540560 6984cff6d03ae45876e96b7fec4136a8
      
      Size/MD5 checksum:   119374 cfd44212e4b5d62bc9bf140bf4054995
      
      Size/MD5 checksum:    51566 af625ce0ebf2721f5a9481a4b5e119c6
      
      Size/MD5 checksum:  2464980 b19f9decc0fd7ef4215d853497d64082
      
      Size/MD5 checksum:   538412 ee0162d17b7ba6b7847d08d27f50d967
      
      Size/MD5 checksum:  2489362 de025813a71a7b0b1209965bb57fa218
      
      Size/MD5 checksum:   598042 2185c46daca7d4b081f612e8247b6129
      
      Size/MD5 checksum:   550982 96b731e339d9ff3df38960cfcb1e7caf
      
      Size/MD5 checksum:    45330 a30de08f2e62fde15f316c554a6800b8
      
      Size/MD5 checksum:   346972 4677e6485e519d90d8eed385b377bbf8

  HP Precision architecture:

      
      Size/MD5 checksum:   513192 51eba589e816ae2b14200d6923a3ade1
      
      Size/MD5 checksum:  6985794 338e3eb6f2dc15796b88b0ac4671d998
      
      Size/MD5 checksum:   105460 bd901d74c3ec5205781851bce7226f36
      
      Size/MD5 checksum:    48964 bb7f6ee31cdee2d338c6747e658af52f
      
      Size/MD5 checksum:  2084626 042caf97086e0ad384371414b963a17b
      
      Size/MD5 checksum:   445474 b751ed5983fe980c8127af6a0da01b34
      
      Size/MD5 checksum:  2189758 5ad9ce3d760959f42f4c5f7e029c21f6
      
      Size/MD5 checksum:   517018 e8a55b4f796115ef43263311bb782bb0
      
      Size/MD5 checksum:   456262 3970caca2ea860ad6715ae01126e1aee
      
      Size/MD5 checksum:    45334 fddf721297cca5b07bae506121d2c229
      
      Size/MD5 checksum:   259614 ac37d3dac4b58cf3ac8ae176a4ff45d8

  Motorola 680x0 architecture:

      
      Size/MD5 checksum:   403152 55c8cb224c709b5cbe392e5d99b042a2
      
      Size/MD5 checksum:  6472374 4d4a1fc3eafa38436117f8fec2ce7a4d
      
      Size/MD5 checksum:    84120 41ef7583f7195fd4d4eca580beddb265
      
      Size/MD5 checksum:    46874 b7b36120c3ea71ff888dcef22339fb70
      
      Size/MD5 checksum:  1632726 c8967a9d522c2e3b3081fbb55245aa62
      
      Size/MD5 checksum:   381006 55c06d0a2e92a6d2f10baa52596ce0f1
      
      Size/MD5 checksum:  1915036 4b4c87e51c0c9956dbdcd86d791c6d00
      
      Size/MD5 checksum:   457528 dd6eaef7d9a94d5966ae6b618c3234d9
      
      Size/MD5 checksum:   393846 20162b8beaed03d0692f2ac1607eedee
      
      Size/MD5 checksum:    45344 ac59effd72b55ec63f8adbb4b991b798
      
      Size/MD5 checksum:   211366 fbaea0782cc52e90e9aef31d21f2524b

  Big endian MIPS architecture:

      
      Size/MD5 checksum:   413108 29ff0a80dd054c1f4931cdacf44fe404
      
      Size/MD5 checksum:  6475834 c1e983e0ff0056df4e6bbc6ab0af9411
      
      Size/MD5 checksum:    80554 92459355041d16af3a47565306f0d5d8
      
      Size/MD5 checksum:    48846 2fb1633106f3b509ed034eb7af54bf00
      
      Size/MD5 checksum:  1530524 77862c6732a82616a2422ea6f72988ea
      
      Size/MD5 checksum:   380842 cf4136bf0b5c80e88ed601b0925aee09
      
      Size/MD5 checksum:  1884486 e14e3946246d08805d8d0107c9cd9e91
      
      Size/MD5 checksum:   477090 40d6ad88fb6da678d316e70b239c78d4
      
      Size/MD5 checksum:   419432 e45d08eab4f5f468749e3fc45b1dfc4c
      
      Size/MD5 checksum:    45336 04f7bea60736940e070534a1d3b364aa
      
      Size/MD5 checksum:   205360 2ac7f073aada97ab56a038e6772ab0f1

  Little endian MIPS architecture:

      
      Size/MD5 checksum:   408158 0ca3969d0094189073261304e2544caf
      
      Size/MD5 checksum:  6448294 b81b50148dc734714d48963053ce60e5
      
      Size/MD5 checksum:    80012 3c767fcfb250d857c1ba1846a68baef8
      
      Size/MD5 checksum:    48952 62dcbd951b837fb7bd76f09788b47c83
      
      Size/MD5 checksum:  1512654 ddc88773fdb5c5ce14ad5108d89c888f
      
      Size/MD5 checksum:   378598 ff5b79ede18320674132db668675d91f
      
      Size/MD5 checksum:  1869070 e29237753588295d3f2a9a31afad687d
      
      Size/MD5 checksum:   473420 833020f22abdb04dc6459224b86023e2
      
      Size/MD5 checksum:   416214 57559eec0d46cb9f0fbae6ec1d4112f8
      
      Size/MD5 checksum:    45330 577ccdb13c76c79253c00c67466f05bf
      
      Size/MD5 checksum:   202814 a37a67286bedc4ae07140ed9f234dd80

  PowerPC architecture:

      
      Size/MD5 checksum:   423964 d3fc8129f4b7921602b9df7ab1b9de6f
      
      Size/MD5 checksum:  6494140 02f058e0b3b916693b51ac55eccdd2e8
      
      Size/MD5 checksum:    84924 656540ee1b6f7c1ec20be24bf131efd0
      
      Size/MD5 checksum:    47946 60b1369752fcb126cb9a44adc9d4917f
      
      Size/MD5 checksum:  1664594 929a7dd3305b76c9297c8deb0d7c6482
      
      Size/MD5 checksum:   387834 44dca94eda6cbe00ebee80768b44cf0a
      
      Size/MD5 checksum:  1930536 03ea5af9e956612eaba89ef4c2a17a60
      
      Size/MD5 checksum:   459102 9ba6631dc8c020c69cf048594697c173
      
      Size/MD5 checksum:   368952 9d1a7b0c108b314e2cc472f9599691eb
      
      Size/MD5 checksum:    45332 10fbb24ba44e4423a84513a580231331
      
      Size/MD5 checksum:   219826 6d51ef66df5cc9d0336637c70c1e3cdc

  IBM S/390 architecture:

      
      Size/MD5 checksum:   434278 31ba9869bf2d68273cf59115a73465da
      
      Size/MD5 checksum:  6575916 8b93871e110b86883eaba8c4537cfefe
      
      Size/MD5 checksum:    84750 bd07fda46bbacdf44219e54ef908129e
      
      Size/MD5 checksum:    47308 3553545f9db49f25951c7a2ada7c7e5f
      
      Size/MD5 checksum:  1698400 7491783da345495131cdedf189f6f769
      
      Size/MD5 checksum:   391534 a9756236891d61e398f2186aadc338c1
      
      Size/MD5 checksum:  1977338 0cdba6fca2234903a1c320a328483d8e
      
      Size/MD5 checksum:   477916 ec0d11ad9c65a4a5dd2438608497a3ed
      
      Size/MD5 checksum:   428072 7825222ddd9f9035edfa4a05bb7a7de0
      
      Size/MD5 checksum:    45328 7a06b706e196d45bddcb0f8324d6e8b4
      
      Size/MD5 checksum:   226906 c6718269d1e9829a1aeec7a1f0790ae9

  Sun Sparc architecture:

      
      Size/MD5 checksum:   426898 ed3e16a8c84e9d3fdc3a49ee30319407
      
      Size/MD5 checksum:  6528296 205f82e13b21142c402374ccbffa7440
      
      Size/MD5 checksum:    86026 ca3fff6a267390750e8561edd8ed8afd
      
      Size/MD5 checksum:    47274 2c2489d57108b616b3b4ef6484f38328
      
      Size/MD5 checksum:  1670568 e93bf69e3ce9dcffb4e5a9a86334e24f
      
      Size/MD5 checksum:   390220 7e97d3e2f38ee71db8bc61c2613c2e17
      
      Size/MD5 checksum:  1939454 f16d7177a66fafd1cb9e8b840a9c22ac
      
      Size/MD5 checksum:   468166 6123ddbb79f8834575045b4441272a03
      
      Size/MD5 checksum:   390696 559e7e5604fca8befdccdac237749f66
      
      Size/MD5 checksum:    45334 a13493bd02632bb5c439a49763f6e54d
      
      Size/MD5 checksum:   218684 94cb63a979fd02118c8f447e0fbab73f


  These files will be moved into the stable distribution after new KDE
  packages have been uploaded into unstable (sid) and compiled for
  all architectures.

---------------------------------------------------------------------------------
For apt-get: deb  Debian -- Security Information  stable/updates main
For dpkg-ftp:    dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and  http://packages.debian.org/