Описание
Security update for kf6-kcoreaddons
This update for kf6-kcoreaddons fixes the following issues:
Changes in kf6-kcoreaddons:
- CVE-2026-41526: Fixed arbitrary code execution via improper shell argument quoting (boo#1263441)
Список пакетов
openSUSE Leap 16.0
kf6-kcoreaddons-6.16.0-bp160.2.1
kf6-kcoreaddons-devel-6.16.0-bp160.2.1
kf6-kcoreaddons-imports-6.16.0-bp160.2.1
kf6-kcoreaddons-lang-6.16.0-bp160.2.1
libKF6CoreAddons6-6.16.0-bp160.2.1
python3-kf6-kcoreaddons-6.16.0-bp160.2.1
Ссылки
- SUSE Security Ratings
- SUSE Bug 1263441
- SUSE CVE CVE-2026-41526 page
Описание
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metacharacters, leading to an escape from the shell. All applications relying on this method in a security-critical path to handle user input are affected and could be exploited. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.
Затронутые продукты
openSUSE Leap 16.0:kf6-kcoreaddons-6.16.0-bp160.2.1
openSUSE Leap 16.0:kf6-kcoreaddons-devel-6.16.0-bp160.2.1
openSUSE Leap 16.0:kf6-kcoreaddons-imports-6.16.0-bp160.2.1
openSUSE Leap 16.0:kf6-kcoreaddons-lang-6.16.0-bp160.2.1
Ссылки
- CVE-2026-41526
- SUSE Bug 1263441