svn commit: r528330 - head/security/vuxml

Fri Mar 13 05:39:13 UTC 2020

Author: tcberner
Date: Fri Mar 13 05:39:11 2020
New Revision: 528330
URL: https://svnweb.freebsd.org/changeset/ports/528330

Log:
  Document security issue in graphics/okular
  
  https://kde.org/info/security/advisory-20200312-1.txt:
  
  Overview
  ========
  Okular can be tricked into executing local binaries via specially crafted
  PDF files.
  
  This binary execution can require almost no user interaction.
  
  No parameters can be passed to those local binaries.
  
  We have not been able to identify any binary that will cause actual damage,
  be it in the hardware or software level, when run without parameters.
  
  We remain relatively confident that for this issue to do any actual damage,
  it has to run a binary specially crafted. That binary must have been deployed
  to the user system via another method, be it the user downloading it directly
  as an email attachment, webpage download, etc. or by the system being already
  compromised.
  
  Solution
  ========
  - Update to Okular >= 1.10.0
  - or apply the following patch:
  https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244
  
  Workaround
  ==========
  There's no real workaround other than not opening PDF files from untrusted sources.
  
  Credits
  =======
  Thanks to Mickael Karatekin from Sysdream Labs for the discovery and to
  Albert Astals Cid for the fix.

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Fri Mar 13 04:48:57 2020	(r528329)
+++ head/security/vuxml/vuln.xml	Fri Mar 13 05:39:11 2020	(r528330)
@@ -58,6 +58,42 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="c3600a64-64ea-11ea-bdff-e0d55e2a8bf9">
+    <topic>Okular -- Local binary execution via action links</topic>
+    <affects>
+      <package>
+	<name>okular</name>
+	<range><lt>19.12.3_2</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Albert Astals Cid:</p>
+	<blockquote cite="https://kde.org/info/security/advisory-20200312-1.txt">
+	  <p>Okular can be tricked into executing local binaries via specially crafted
+	    PDF files.</p>
+	  <p>This binary execution can require almost no user interaction.</p>
+	  <p>   No parameters can be passed to those local binaries.</p>
+	  <p>We have not been able to identify any binary that will cause actual damage,
+	    be it in the hardware or software level, when run without parameters.</p>
+
+	  <p>We remain relatively confident that for this issue to do any actual damage,
+it has to run a binary specially crafted. That binary must have been deployed
+to the user system via another method, be it the user downloading it directly
+as an email attachment, webpage download, etc. or by the system being already
+compromised.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://kde.org/info/security/advisory-20200312-1.txt</url>
+    </references>
+    <dates>
+      <discovery>2020-03-12</discovery>
+      <entry>2020-03-13</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="9a09eaa2-6448-11ea-abb7-001b217b3468">
     <topic>Gitlab -- Vulnerability</topic>
     <affects>
