Daniele Bianco

The issue is related to multiple vulnerabilities in various packages of the kdenetwork suite, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely by an authenticated attacker. Additionally, there are stack-based buffer overflows in the File Transfer feature of LibVNCServer, which can cause a denial of service and possibly allow the execution of arbitrary code.

The issue is related to an integer overflow in the MallocFrameBuffer function, which can be triggered by a remote VNC server advertising a large screen size. This can cause a heap-based buffer overflow, potentially leading to a denial of service (crash) and possibly allowing the execution of arbitrary code. The vulnerability may also allow a remote attacker to access confidential data, compromise its integrity, and cause a disruption of service.

The issue allows remote servers to create or overwrite arbitrary files via a 3xx redirect to a URL with a .wgetrc filename followed by a 3xx redirect to a URL with a crafted filename. This could possibly lead to the execution of arbitrary code as a consequence of writing to a dotfile in a home directory. Exploitation of this issue may lead to a breach of confidentiality, integrity, and availability of protected information and can be carried out remotely.

The issue allows remote servers to create or overwrite files through a 3xx redirect to a URL with a crafted filename or a Content-Disposition header that suggests a crafted filename. This can possibly lead to the execution of arbitrary code as a consequence of writing to a dotfile in a home directory. The problem arises because the software does not reject downloads to filenames that begin with a . (dot) character.