---

Security patch for KDE libraries

Matthias Hoelzer-Kluepfe
writes:

Lately, a problem in one of the KDE libs, libmediatool, was
reported. The problem allows local users to create or modify files
as the user running KDE.

A patch for the problem was made available by Christian Esken
(KDE core team) and Olaf Kirch (Caldera Systems).

Please apply the patch to your installations as soon as
possible. The advisory is attached.

————————————————————–

1. Problem Description

Local users may create files as the user running KDE.

One of KDE’s libraries, libmediatool, has a /tmp race problem.
The problem is the way the library creates /tmp files. You can
predict when a file will be created and create a symlink with the
same name.

2. Vulnerable Versions

kdelibs <= 1.1

3. Solutions

The proper solution is to apply the patch


ftp://ftp.kde.org/pub/kde/security_patches/kdelibs-1.1-connect.patch

4. Verification

The MD5 checksum (from the “md5sum” command) for the patch
is:

8742ccc0fc1d2bf94e426747b9da3894 kdelibs-1.1-connect.patch