USN-8857-1: KCoreAddons vulnerability
Ubuntu warned that KCoreAddons mishandles shell quoting, allowing possible command execution via KShell::quoteArgs.
Ubuntu security notice USN-8857-1 says KCoreAddons incorrectly quoted shell arguments in KShell::quoteArgs. Parsing did not adequately handle shell metacharacters, which could allow a shell escape. An attacker could possibly execute arbitrary commands in applications that relied on this method to handle user input. The notice does not name a CVE or report exploitation.
- Flaw is in KShell::quoteArgs shell-argument quoting.
- Unescaped shell metacharacters can produce a shell escape.
- Apps passing user input through the method may run attacker commands.
- Published as USN-8857-1; the notice names no CVE.
- Products
- KCoreAddons
From the original article
It was discovered that KCoreAddons incorrectly handled shell argument quoting in KShell::quoteArgs. The parsing did not adequately handle shell metacharacters, which could lead to a shell escape. An attacker could possibly use this issue to execute arbitrary commands in applications that relied on this method to handle user input.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.