group.of.nepali.translators team mailing list archive

[Launchpad Bug Tracker <1731797@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package konversation - 1.7.2-1ubuntu1.1

---------------
konversation (1.7.2-1ubuntu1.1) artful-security; urgency=high

  * SECURITY UPDATE: Crash in IRC message parsing (LP: #1731797):
    - CVE-2017-15923.patch: ensure integer overflow has not happened
    - CVE-2017-15923
    - https://www.kde.org/info/security/advisory-20171112-1.txt

 -- Simon Quigley <tsimonq2@xxxxxxxxxx>  Tue, 21 Nov 2017 11:34:38 -0800

** Changed in: konversation (Ubuntu Artful)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1731797

Title:
  [CVE] Crash in IRC message parsing

Status in Kubuntu PPA:
  In Progress
Status in konversation package in Ubuntu:
  Fix Released
Status in konversation source package in Trusty:
  Fix Released
Status in konversation source package in Xenial:
  In Progress
Status in konversation source package in Zesty:
  Fix Released
Status in konversation source package in Artful:
  Fix Released
Status in konversation source package in Bionic:
  Fix Released

Bug description:
  KDE Project Security Advisory
  =============================

  Title:          Konversation: Crash in IRC message parsing
  Risk Rating:    High
  CVE:            CVE-2017-15923
  Versions:       konversation <= 1.7.2
  Date:           12 November 2017

  
  Overview
  ========
  Konversation has support for colors in IRC messages. Any malicious user connected to the
  same IRC network can send a carefully crafted message that will crash the Konversation user client.

  
  Workaround
  ==========
  Go to Interface → Colors in the Configure Konversation dialog and uncheck Allow Colored Text in IRC Messages (near the bottom)

  Solution
  ========
  Update to Konversation > 1.7.2

  Or apply the following patches:
  1.7: https://cgit.kde.org/konversation.git/commit/?h=1.7&id=34cc9556c1a089fac6b674d3bd6f2248e9512902
  1.6: https://cgit.kde.org/konversation.git/commit/?h=1.6&id=cebf8d7658b0e3afb0292c273704ec4d2ea4019f
  1.5: https://cgit.kde.org/konversation.git/commit/?h=1.5&id=6a7f59ee1b9dbc6e5cf9e5f3b306504d02b73ef0
  1.4: the patch for 1.5 will apply, but you should upgrade

  Credits
  =======
  Thanks to Joseph Bisch for the report and to Eli MacKenzie for the fix.

To manage notifications about this bug go to:
https://bugs.launchpad.net/kubuntu-ppa/+bug/1731797/+subscriptions