Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 665662 (CVE-2018-1000801)

Summary: <kde-apps/okular-{18.04.3-r1,18.08.1}: path traversal issue when extracting crafted .okular file (CVE-2018-1000801)
Product: Gentoo Security Reporter: Andreas Sturmlechner <asturm>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal Flags: stable-bot: sanity-check+
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://phabricator.kde.org/D15192
See Also: https://bugs.kde.org/show_bug.cgi?id=398096
Whiteboard: B2 [glsa+ cve]
Package list:
kde-apps/okular-18.04.3-r1
Runtime testing required: ---

Description Andreas Sturmlechner gentoo-dev 2018-09-10 20:37:49 UTC
Description follows shortly.
Comment 1 Larry the Git Cow gentoo-dev 2018-09-10 20:38:35 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=75a72fe24a730420ec692367e4e108d4a0a6d617

commit 75a72fe24a730420ec692367e4e108d4a0a6d617
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2018-09-10 20:33:04 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2018-09-10 20:38:03 +0000

    kde-apps/okular: Fix path traversal issue when extracting .okular file
    
    With a specially crafted .okular files it was possible to trick okular
    to create temporary files outside the temporary folder.
    
    Bug: https://bugs.gentoo.org/665662
    KDE-Bug: https://bugs.kde.org/show_bug.cgi?id=398096
    See also: https://phabricator.kde.org/D15192
    Package-Manager: Portage-2.3.49, Repoman-2.3.10

 .../okular-18.04.3-path-traversal-issue.patch      |  46 +++++++++
 kde-apps/okular/okular-18.04.3-r1.ebuild           | 106 +++++++++++++++++++++
 2 files changed, 152 insertions(+)
Comment 2 Thomas Deutschmann gentoo-dev Security 2018-09-10 21:21:52 UTC
x86 stable
Comment 3 Agostino Sarubbo gentoo-dev 2018-09-13 14:46:56 UTC
amd64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 4 Larry the Git Cow gentoo-dev 2018-09-13 16:57:38 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4b40ed9ef781f864d1d0db41eed739374ac29658

commit 4b40ed9ef781f864d1d0db41eed739374ac29658
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2018-09-13 16:54:37 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2018-09-13 16:57:10 +0000

    kde-apps/okular: Security cleanup
    
    Bug: https://bugs.gentoo.org/665662
    Package-Manager: Portage-2.3.49, Repoman-2.3.10

 kde-apps/okular/okular-18.04.3.ebuild | 103 ----------------------------------
 1 file changed, 103 deletions(-)
Comment 5 Andreas Sturmlechner gentoo-dev 2018-09-15 21:55:20 UTC
kde is done here, in case you didn't notice.
Comment 6 Andreas Sturmlechner gentoo-dev 2018-10-09 08:20:50 UTC
ping sec...
Comment 7 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2018-10-09 10:06:38 UTC
(In reply to Andreas Sturmlechner from comment #6)
> ping sec...

Pong min...

glsa request was filed
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2018-11-10 00:27:04 UTC
This issue was resolved and addressed in
 GLSA 201811-08 at https://security.gentoo.org/glsa/201811-08
by GLSA coordinator Thomas Deutschmann (whissi).