Bug 985362 - (CVE-2013-4133) CVE-2013-4133 kde-workspace: DoS due memory leak in plasma desktop when handling blinking system tray icons
CVE-2013-4133 kde-workspace: DoS due memory leak in plasma desktop when handl...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20130716,reported=2...
: Security
Depends On: 985365
Blocks: 985389
  Show dependency treegraph
 
Reported: 2013-07-17 06:57 EDT by Jan Lieskovsky
Modified: 2016-03-04 05:40 EST (History)
10 users (show)

See Also:
Fixed In Version: kde-workspace-4.10.5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-07-26 15:46:22 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2013-07-17 06:57:58 EDT
A memory leak, leading to denial of service flaw was found in the way Plasma desktop of the KDE workspace, the desktop of the KDE desktop environment, used to handle situations when certain system tray icons have been blinking (due to a memory leak the blinking icon previously caused raising consumption of memory). A remote attacker could use this flaw to cause Plasma desktop (X session) to be slow, possibly leading to Plasma desktop crashes via issuing notifications to the desktop of the victim user causing some certain system tray icon to start blinking (via IRC client for example).

Upstream bug report:
[1] https://bugs.kde.org/show_bug.cgi?id=314919

Relevant upstream patch:
[2] https://projects.kde.org/projects/kde/kde-workspace/repository/revisions/2c810db3e41d56ad7dd8ec3436f3cf3abcc31983
Comment 1 Jan Lieskovsky 2013-07-17 07:00:28 EDT
This issue previously affected the versions of the kde-workspace package, as shipped with Fedora release of 17, 18, and 19. But updates have been already scheduled (in -candidate repository currently), to correct this issue.
Comment 4 Jan Lieskovsky 2013-07-17 07:21:39 EDT
This issue did NOT affect the version of the kdebase-workspace package, as shipped with Red Hat Enterprise Linux 6.
Comment 5 Huzaifa S. Sidhpurwala 2013-08-01 00:59:06 EDT
Statement:

Not Vulnerable. This issue does not affect the version of kdebase package as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of kdebase-workspace package as shipped with Red Hat Enterprise Linux 6.

Note You need to log in before you can comment on or make changes to this bug.