Bug 985362 (CVE-2013-4133)

Summary:	CVE-2013-4133 kde-workspace: DoS due memory leak in plasma desktop when handling blinking system tray icons
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dvratil, jgrulich, jreznik, kevin, ltinkl, mbriza, rdieter, rnovacek, than, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kde-workspace-4.10.5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-07-26 19:46:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	985365
Bug Blocks:	985389

Description Jan Lieskovsky 2013-07-17 10:57:58 UTC

A memory leak, leading to denial of service flaw was found in the way Plasma desktop of the KDE workspace, the desktop of the KDE desktop environment, used to handle situations when certain system tray icons have been blinking (due to a memory leak the blinking icon previously caused raising consumption of memory). A remote attacker could use this flaw to cause Plasma desktop (X session) to be slow, possibly leading to Plasma desktop crashes via issuing notifications to the desktop of the victim user causing some certain system tray icon to start blinking (via IRC client for example).

Upstream bug report:
[1] https://bugs.kde.org/show_bug.cgi?id=314919

Relevant upstream patch:
[2] https://projects.kde.org/projects/kde/kde-workspace/repository/revisions/2c810db3e41d56ad7dd8ec3436f3cf3abcc31983

Comment 1 Jan Lieskovsky 2013-07-17 11:00:28 UTC

This issue previously affected the versions of the kde-workspace package, as shipped with Fedora release of 17, 18, and 19. But updates have been already scheduled (in -candidate repository currently), to correct this issue.

Comment 4 Jan Lieskovsky 2013-07-17 11:21:39 UTC

This issue did NOT affect the version of the kdebase-workspace package, as shipped with Red Hat Enterprise Linux 6.

Comment 5 Huzaifa S. Sidhpurwala 2013-08-01 04:59:06 UTC

Statement:

Not Vulnerable. This issue does not affect the version of kdebase package as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of kdebase-workspace package as shipped with Red Hat Enterprise Linux 6.