Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 665662 (CVE-2018-1000801) - <kde-apps/okular-{18.04.3-r1,18.08.1}: path traversal issue when extracting crafted .okular file (CVE-2018-1000801)
Summary: <kde-apps/okular-{18.04.3-r1,18.08.1}: path traversal issue when extracting c...
Alias: CVE-2018-1000801
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B2 [glsa+ cve]
Depends on:
Reported: 2018-09-10 20:37 UTC by Andreas Sturmlechner
Modified: 2018-11-10 00:27 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---
stable-bot: sanity-check+


Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Sturmlechner gentoo-dev 2018-09-10 20:37:49 UTC
Description follows shortly.
Comment 1 Larry the Git Cow gentoo-dev 2018-09-10 20:38:35 UTC
The bug has been referenced in the following commit(s):

commit 75a72fe24a730420ec692367e4e108d4a0a6d617
Author:     Andreas Sturmlechner <>
AuthorDate: 2018-09-10 20:33:04 +0000
Commit:     Andreas Sturmlechner <>
CommitDate: 2018-09-10 20:38:03 +0000

    kde-apps/okular: Fix path traversal issue when extracting .okular file
    With a specially crafted .okular files it was possible to trick okular
    to create temporary files outside the temporary folder.
    See also:
    Package-Manager: Portage-2.3.49, Repoman-2.3.10

 .../okular-18.04.3-path-traversal-issue.patch      |  46 +++++++++
 kde-apps/okular/okular-18.04.3-r1.ebuild           | 106 +++++++++++++++++++++
 2 files changed, 152 insertions(+)
Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev 2018-09-10 21:21:52 UTC
x86 stable
Comment 3 Agostino Sarubbo gentoo-dev 2018-09-13 14:46:56 UTC
amd64 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 4 Larry the Git Cow gentoo-dev 2018-09-13 16:57:38 UTC
The bug has been referenced in the following commit(s):

commit 4b40ed9ef781f864d1d0db41eed739374ac29658
Author:     Andreas Sturmlechner <>
AuthorDate: 2018-09-13 16:54:37 +0000
Commit:     Andreas Sturmlechner <>
CommitDate: 2018-09-13 16:57:10 +0000

    kde-apps/okular: Security cleanup
    Package-Manager: Portage-2.3.49, Repoman-2.3.10

 kde-apps/okular/okular-18.04.3.ebuild | 103 ----------------------------------
 1 file changed, 103 deletions(-)
Comment 5 Andreas Sturmlechner gentoo-dev 2018-09-15 21:55:20 UTC
kde is done here, in case you didn't notice.
Comment 6 Andreas Sturmlechner gentoo-dev 2018-10-09 08:20:50 UTC
ping sec...
Comment 7 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2018-10-09 10:06:38 UTC
(In reply to Andreas Sturmlechner from comment #6)
> ping sec...

Pong min...

glsa request was filed
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2018-11-10 00:27:04 UTC
This issue was resolved and addressed in
 GLSA 201811-08 at
by GLSA coordinator Thomas Deutschmann (whissi).