[ Thanks to Dre for
this link. ]
A possible local root exploit effecting all versions of
artswrapper (introduced in KDE 2 pre-releases) was posted late
Sunday to some of the well-known security websites. The exploit
only affects installations which have installed artswrapper setuid
“root”. A patch (GPG signature) against KDE 3.0.2 was released
almost immediately (thanks to George Staikos and Dirk Mueller), and
new packages are being built. In the meantime, it is strongly
recommended that system administrators unset the setuid bit on
artswrapper (e.g., chmod ug-s artswrapper), particularly on
multi-user machines. More details, as they arise, will be posted to
the KDE 3.0.2 Info
Page.