CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2018-1000801 – okular: Directory traversal in function unpackDocumentArchive() in core/document.cpp
https://notcve.org/view.php?id=CVE-2018-1000801
okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1 okular en versiones 18.08 y anteriores contiene una vulnerabilidad de salto de directorio en la función "unpackDocumentArchive(...)" en "core/document.cpp" que puede resultar en la creación de archivos arbitrarios en la estación de trabajo del usuario. El ataque parece ser explotable si una víctima abre un archivo Okular especialmente manipulado. El problema parece haber sido solucionado en la versión 18.08.1. • https://bugs.kde.org/show_bug.cgi?id=398096 https://cgit.kde.org/okular.git/commit/?id=8ff7abc14d41906ad978b6bc67e69693863b9d47 https://lists.debian.org/debian-lts-announce/2018/09/msg00027.html https://security.gentoo.org/glsa/201811-08 https://www.debian.org/security/2018/dsa-4303 https://access.redhat.com/security/cve/CVE-2018-1000801 https://bugzilla.redhat.com/show_bug.cgi?id=1626265 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.9EPSS: 0%CPEs: 21EXPL: 1CVE-2017-17689
https://notcve.org/view.php?id=CVE-2017-17689
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. La especificación S/MIME permite un ataque malleability-gadget Cipher Block Chaining (CBC) que puede conducir indirectamente a la exfiltración en texto plano. Esto también se conoce como EFAIL. • http://www.securityfocus.com/bid/104165 https://efail.de https://news.ycombinator.com/item?id=17066419 https://pastebin.com/gNCc8aYm https://twitter.com/matthew_d_green/status/996371541591019520 https://www.synology.com/support/security/Synology_SA_18_22 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-10380
https://notcve.org/view.php?id=CVE-2018-10380
kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack. kwallet-pam en KDE KWallet en versiones anteriores a la 5.12.6 permite que los usuarios locales obtengan la propiedad de archivos arbitrarios mediante un ataque symlink. • https://bugzilla.suse.com/show_bug.cgi?id=1090863 https://commits.kde.org/kwallet-pam/01d4143fda5bddb6dca37b23304dc239a5fb38b5 https://commits.kde.org/kwallet-pam/2134dec85ce19d6378d03cddfae9e5e464cb24c0 https://commits.kde.org/kwallet-pam/802f305d81f8771c4f4a8bd7fd0e368ffc6f9b3b https://commits.kde.org/kwallet-pam/99abc7fde21f40cc6da5feb6ee766cc46fcca1f8 https://www.debian.org/security/2018/dsa-4200 https://www.kde.org/info/security/advisory-20180503-1.txt • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-10361
https://notcve.org/view.php?id=CVE-2018-10361
An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to gain root privileges. The attack occurs when one user (who has an unprivileged account but is also able to authenticate as root) writes a text file using Kate into a directory owned by a another unprivileged user. The latter unprivileged user conducts a symlink attack to achieve privilege escalation. Se ha descubierto un problema en KTextEditor, desde la versión 5.34.0 hasta la 5.45.0. • http://www.openwall.com/lists/oss-security/2018/04/24/1 http://www.openwall.com/lists/oss-security/2019/07/09/3 https://bugzilla.suse.com/show_bug.cgi?id=1033055 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6790 – kde-workspace: Missing sanitization of notifications allows to leak client IP address via IMG element
https://notcve.org/view.php?id=CVE-2018-6790
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG element. Se ha descubierto un problema en KDE Plasma Workspace en versiones anteriores a la 5.12.0 en el que dataengines/notifications/notificationsengine.cpp permite que los atacantes remotos descubran las direcciones IP de los clientes mediante una URL en una notificación, tal y como queda demostrado con el atributo src de un elemento IMG. • https://access.redhat.com/errata/RHSA-2019:2141 https://cgit.kde.org/plasma-workspace.git/commit/?id=5bc696b5abcdb460c1017592e80b2d7f6ed3107c https://cgit.kde.org/plasma-workspace.git/commit/?id=8164beac15ea34ec0d1564f0557fe3e742bdd938 https://phabricator.kde.org/D10188 https://www.kde.org/announcements/plasma-5.11.5-5.12.0-changelog.php https://access.redhat.com/security/cve/CVE-2018-6790 https://bugzilla.redhat.com/show_bug.cgi?id=1543454 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •