-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2008-2122 2008-04-08 23:41:29 --------------------------------------------------------------------------------
Name : konversation Product : Fedora 7 Version : 1.0.1 Release : 4.fc7 URL : http://konversation.kde.org Summary : Konversation is a user friendly IRC client for KDE Description : A simple and easy to use IRC client for KDE with support for strikeout; multi-channel joins; away / unaway messages; ignore list functionality; (experimental) support for foreign language characters; auto-connect to server; optional timestamps to chat windows; configurable background colors and much more
-------------------------------------------------------------------------------- Update Information:
removes /usr/share/apps/konversation/scripts/media which can be used to execute commands via carefully crafted media -------------------------------------------------------------------------------- ChangeLog:
* Thu Feb 7 2008 Dennis Gilmore dennis@ausil.us - 1.0.1-4 - remove /usr/share/apps/konversation/scripts/media for CVE-2007-4400 * Tue Aug 28 2007 Dennis Gilmore dennis@ausil.us - 1.0.1-3 - clarify license GPLv2+, and rebuild for F8 -------------------------------------------------------------------------------- References:
[ 1 ] Bug #253545 - CVE-2007-4400 konversation: Command injection in media script via crafted song tag https://bugzilla.redhat.com/show_bug.cgi?id=253545 --------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use su -c 'yum update konversation' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys --------------------------------------------------------------------------------
package-announce@lists.fedoraproject.org