"Overview ======== KCron is a module for the System Settings application. The module identifies itself with the "Task Scheduler" user visible name. It allows users to edit crontabs (both user-specific and system-wide) in a GUI interface. The code of the module doesn't use temporary files correctly neither when reading the existing crontab nor when saving the new one. Impact ====== Your private tasks may be exposed to other users of the system. The system tasks may be replaced by other users of the system that don't have rights to edit them." Please bump to 21.12.3.
Only unstable is affected according to asturm.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bf4fae8831448c205eb4572e5ce90074399f2beb commit bf4fae8831448c205eb4572e5ce90074399f2beb Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2022-02-16 18:57:15 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2022-02-16 18:58:44 +0000 kde-apps/kcron: Cleanup vulnerable 21.12.2 (r0) Bug: https://bugs.gentoo.org/833500 Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> kde-apps/kcron/kcron-21.12.2.ebuild | 32 -------------------------------- 1 file changed, 32 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f560da8a6e7041b35277af4f5b6576cd6799ee7f commit f560da8a6e7041b35277af4f5b6576cd6799ee7f Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2022-02-16 18:46:51 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2022-02-16 18:58:43 +0000 kde-apps/kcron: Fix CVE-2022-24986 See also: https://kde.org/info/security/advisory-20220216-1.txt Bug: https://bugs.gentoo.org/833500 Package-Manager: Portage-3.0.30, Repoman-3.0.3 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> .../kcron/files/kcron-21.12.2-CVE-2022-24986.patch | 291 +++++++++++++++++++++ .../kcron-21.12.2-KCronHelper-return-error.patch | 44 ++++ kde-apps/kcron/kcron-21.12.2-r1.ebuild | 37 +++ 3 files changed, 372 insertions(+)
kde proj is done again.
Very easy, all done!
