Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 180060

Summary:	CAN-2005-2101 kdeedu- langen2kvtml tempfile vulnerability
Product:	[Retired] Fedora Legacy	Reporter:	David Eisenstein <deisenst>
Component:	kdeedu	Assignee:	Fedora Legacy Bugs <bugs>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://www.kde.org/info/security/advisory-20050815-1.txt
Whiteboard:	impact=low, LEGACY, NEEDSWORK, rh73, rh90, 1, 2
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-08-30 19:57:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	179804

Description David Eisenstein 2006-02-05 08:49:30 UTC

+++ This bug was initially created as a clone of Bug #165606 +++

Ben Burton notified the KDE security team about several tempfile handling
related vulnerabilities in langen2kvtml, a conversion script for kvoctrain. The
script must be manually invoked.

The script uses known filenames in /tmp which allow an local attacker to
overwrite files writeable by the user invoking the conversion script.


This issue should also affect FC3

-- Additional comment from bressers on 2005-08-10 14:59 EST --
Created an attachment (id=117621)
Proposed upstream patch


-- Additional comment from than on 2005-08-10 16:25 EST --
it's now fixed in kdeedu-3.4.2-0.fc4.2 (FC4) and kdeedu-3.4.2-0.fc3.2 (FC3)

-- Additional comment from mjc on 2005-10-25 07:48 EST --
FEDORA-2005-745
FEDORA-2005-744

Comment 1 David Eisenstein 2006-02-05 08:53:39 UTC

This issue currently only affects RHL7.3, RHL9, FC1, & FC2.

Comment 2 Jesse Keating 2007-08-30 19:57:31 UTC

Fedora Legacy project has ended.  These will not be fixed by Fedora Legacy.