Bug 595534 – <kde-plasma/kde-cli-tools-5.7.5: sneak invisible characters

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2016-09-29 14:09:24 UTC]

From ${URL} :

The problem is that you could sneak an unicode string terminator in the kdesu invocation
and the label showing which command will be executed ended there but we did execute the whole thing,
that is,
  
   echo Hi@; whoami > /tmp/filebyroot

If @ is the unicode string terminator would only tell the user kdesu would execute "echo Hi"
but would create the /tmp/filebyroot file as root

The fix is already available at
https://github.com/KDE/kde-cli-tools/commit/5eda179a099ba68a20dc21dc0da63e85a565a171



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Michael Palimaka (kensington) 2016-09-29 16:36:06 UTC]

Arch teams, please test and stabilise kde-plasma/kde-cli-tools-5.6.5-r1.

Target KEYWORDS="amd64 x86".

[Comment 2 Agostino Sarubbo 2016-09-30 07:13:54 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2016-09-30 07:14:21 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 4 Michael Palimaka (kensington) 2016-10-02 17:28:50 UTC]

Cleanup complete.

[Comment 5 Johannes Huber (RETIRED) 2016-11-02 10:20:18 UTC]

(In reply to Michael Palimaka (kensington) from comment #4)
> Cleanup complete.

Thanks. Removing maintainer then.