Package: plasma-workspace / 4:5.8.6-2.1+deb9u1

Metadata

Package Version Patches format
plasma-workspace 4:5.8.6-2.1+deb9u1 3.0 (quilt)

Patch series

view the series file
Patch File delta Description
kubuntu_startkde qtpath.diff | (download)

startkde/CMakeLists.txt | 2 2 + 0 - 0 !
startkde/startkde.cmake | 6 4 + 2 - 0 !
2 files changed, 6 insertions(+), 2 deletions(-)

 kubuntu_startkde-qtpath

===================================================================

disable_incompatible_tests | (download)

kioslave/desktop/tests/CMakeLists.txt | 4 2 + 2 - 0 !
1 file changed, 2 insertions(+), 2 deletions(-)

 disable_incompatible_tests

===================================================================

add_sddm_debian_breeze.patch | (download)

CMakeLists.txt | 11 11 + 0 - 0 !
sddm-theme-debian/metadata.desktop | 17 17 + 0 - 0 !
sddm-theme-debian/theme.conf | 2 2 + 0 - 0 !
3 files changed, 30 insertions(+)

---
replace fds.patch | (download)

ksplash/ksplashqml/main.cpp | 20 13 + 7 - 0 !
1 file changed, 13 insertions(+), 7 deletions(-)

 not close stdin,stdout,stderr, and redirects stdin,stdout,stderr to /dev/null
 This fix a bug in ksplashqml. An upstream commit
 https://cgit.kde.org/plasma-workspace.git/commit/?id=56d2c15b9acb9c4b57398b281685807c3191f622
 has caused this problem.

 x-session-manag,133,kdetest /usr/bin/x-session-manager
   +-(ksplashqml,232)
   +-ssh-agent,191 /usr/bin/im-launch x-session-manager
   +-uim-toolbar,220
   |   +-{llvmpipe-0},235
   |   +-{llvmpipe-1},236
   |   +-{llvmpipe-2},237
   |   `-{llvmpipe-3},238
   `-uim-xim,219
 ksplashqml,233,kdetest Breeze --pid
   +-mozc_server,239
   |   +-{IPCServer},244
   |   +-{QueueTimer},240
   |   +-{QueueTimer},243
   |   `-{WatchDog},242
   +-uim-candwin-qt5,245 -v
   |   +-{QDBusConnection},249
   |   `-{QXcbEventReader},248
   |-{QDBusConnection},255
   |-{QQmlThread},254
   |-{QXcbEventReader},234
   |-{llvmpipe-0},250
   |-{llvmpipe-1},251
   |-{llvmpipe-2},252
   `-{llvmpipe-3},253
 
 # strace -f -p 133
 strace: Process 133 attached
 read(3, ^Cstrace: Process 133 detached
  <detached ...>
 
 It looks like the parent process (133), x-session-manager (startkde
 script), is waiting for the stdout of the ksplashqml process (232),
 but which is now defunct. Its child process(es) may be writing to the
 same fd.
 
 # ls -l /proc/133/fd/3
 lr-x
CVE 2018 6791.patch | (download)

soliduiserver/deviceserviceaction.cpp | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 make sure device paths are quoted

in the case a vfat removable device has $() or `` in its label,
such as $(touch foo) the quoted command may get executed,
leaving an attack vector. Use KMacroExpander::expandMacrosShellQuote
to make sure everything is quoted and not interpreted as a command

BUG:389815