Path traversal in KDE Frameworks - CVE-2016-6232

Vulnerability identifier: #VU20302

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6232

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in KArchive before 5.24, as used in KDE Frameworks. A remote attacker can trick the victim to open a specially crafted archive and data write to arbitrary files via a ./ (dot dot slash) in a filename, related to KNewsstuff downloads.

KDE Frameworks
kde4libs (Ubuntu package)
kconfig (Ubuntu package)
kf5-kcoreaddons
kf5-ki18n
kf5-kcrash
kf5-kdbusaddons
kf5-kdeclarative
kf5-kded
kf5-kdelibs4support
kf5-kdesignerplugin
kf5-kdesu
kf5-kdewebkit
kf5-kdnssd
kf5-kdoctools
kf5-kemoticons
kf5-kfilemetadata
kf5-kglobalaccel
kf5-kguiaddons
kf5-khtml
breeze-icon-theme
kf5-kactivities-stats
kf5-threadweaver
extra-cmake-modules
kf5
kf5-attica
kf5-baloo
kf5-bluez-qt
kf5-frameworkintegration
kf5-kactivities
kf5-kconfigwidgets
kf5-kapidox
kf5-karchive
kf5-kauth
kf5-kbookmarks
kf5-kcmutils
kf5-kcodecs
kf5-kcompletion
kf5-kconfig
kf5-kwidgetsaddons
kf5-kpty
kf5-kross
kf5-krunner
kf5-kservice
kf5-ktexteditor
kf5-ktextwidgets
kf5-kunitconversion
kf5-kwallet
kf5-kplotting
kf5-kwindowsystem
kf5-kxmlgui
kf5-kxmlrpcclient
kf5-modemmanager-qt
kf5-networkmanager-qt
kf5-plasma
kf5-solid
kf5-sonnet
kf5-kjsembed
kf5-kidletime
kf5-kimageformats
kf5-kinit
kf5-kio
kf5-kitemmodels
kf5-kitemviews
kf5-kjobwidgets
kf5-kjs
kf5-kiconthemes
kf5-kmediaplayer
kf5-knewstuff
kf5-knotifications
kf5-knotifyconfig
kf5-kpackage
kf5-kparts
kf5-kpeople
kf5-kwayland
oxygen-icon-theme
Fedora
Opensuse
SUSE Package Hub for SUSE Linux Enterprise

Install update from vendor's website.

KDE Frameworks - update to 5.24.0
kde4libs (Ubuntu package) - addressed in versions 4:4.8.5-0ubuntu0.5, 4:4.13.3-0ubuntu0.3, 4:4.14.13-0ubuntu1.1, 4:4.14.16-0ubuntu3.3, 4:4.14.38-0ubuntu3.1, 4:4.14.38-0ubuntu6.1
kconfig (Ubuntu package) - addressed in versions 5.18.0-0ubuntu1.1, 5.44.0-0ubuntu1.1, 5.56.0-0ubuntu1.1
kf5-kcoreaddons - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-ki18n - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kcrash - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdbusaddons - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdeclarative - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kded - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdelibs4support - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdesignerplugin - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdesu - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdewebkit - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdnssd - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kdoctools - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kemoticons - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kfilemetadata - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kglobalaccel - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kguiaddons - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-khtml - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
breeze-icon-theme - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kactivities-stats - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-threadweaver - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
extra-cmake-modules - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5 - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-attica - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-baloo - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-bluez-qt - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-frameworkintegration - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kactivities - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kconfigwidgets - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kapidox - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-karchive - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kauth - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kbookmarks - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kcmutils - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kcodecs - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kcompletion - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kconfig - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kwidgetsaddons - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kpty - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kross - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-krunner - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kservice - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-ktexteditor - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-ktextwidgets - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kunitconversion - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kwallet - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kplotting - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kwindowsystem - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kxmlgui - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kxmlrpcclient - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-modemmanager-qt - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-networkmanager-qt - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-plasma - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-solid - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-sonnet - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kjsembed - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kidletime - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kimageformats - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kinit - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kio - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kitemmodels - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kitemviews - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kjobwidgets - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kjs - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kiconthemes - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kmediaplayer - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-knewstuff - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-knotifications - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-knotifyconfig - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kpackage - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kparts - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kpeople - addressed in versions 5.24.0-1.el7, 5.24.0-1.fc23, 5.24.0-1.fc24
kf5-kwayland - addressed in versions 5.24.0-1.fc23, 5.24.0-1.fc24
oxygen-icon-theme - addressed in versions 5.24.0-1.fc23, 5.24.0-1.fc24

• http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00023.html
• http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00000.html
• http://www.debian.org/security/2016/dsa-3643
• http://www.openwall.com/lists/oss-security/2016/07/16/2
• http://www.openwall.com/lists/oss-security/2016/07/16/3
• http://www.ubuntu.com/usn/USN-3042-1
• https://quickgit.kde.org/?p=karchive.git&a=commit&h=0cb243f64eef45565741b27364cece7d5c349c37
• https://www.kde.org/info/security/advisory-20160724-1.txt

• Ubuntu update for KConfig and KDE libraries
• Path traversal in KDE Frameworks
• Ubuntu update for KDE-Libs
• OpenSUSE Linux update for karchive
• OpenSUSE Linux update for karchive
• Fedora 23 update for breeze-icon-theme, extra-cmake-modules, kf5, kf5-attica, kf5-baloo, kf5-bluez-qt, kf5-frameworkintegration, kf5-kactivities, kf5-kactivities-stats, kf5-kapidox, kf5-karchive, kf5-kauth, kf5-kbookmarks, kf5-kcmutils, kf5-kcodecs, kf5-k
• Fedora 24 update for breeze-icon-theme, extra-cmake-modules, kf5, kf5-attica, kf5-baloo, kf5-bluez-qt, kf5-frameworkintegration, kf5-kactivities, kf5-kactivities-stats, kf5-kapidox, kf5-karchive, kf5-kauth, kf5-kbookmarks, kf5-kcmutils, kf5-kcodecs, kf5-k
• Fedora EPEL 7 update for breeze-icon-theme, extra-cmake-modules, kf5, kf5-attica, kf5-baloo, kf5-bluez-qt, kf5-frameworkintegration, kf5-kactivities, kf5-kactivities-stats, kf5-kapidox, kf5-karchive, kf5-kauth, kf5-kbookmarks, kf5-kcmutils, kf5-kcodecs, k