[ GLSA 201811-08 ] Okular

[GLSA]

Gentoo Linux Security Advisory

Title: Okular: Directory traversal (GLSA 201811-08)
Severity: normal
Exploitable: remote
Date: 2018-11-10
Bug(s): #665662
ID: 201811-08

Synopsis

Okular is vulnerable to a directory traversal attack.

Background

Okular is a universal document viewer based on KPDF for KDE 4.

Affected Packages

Package: kde-apps/okular
Vulnerable: < 18.04.3-r1
Unaffected: >= 18.04.3-r1
Architectures: All supported architectures


Description

It was discovered that Okular contains a Directory Traversal
vulnerability in function unpackDocumentArchive() in core/document.cpp.


Impact

A remote attacker could entice a user to open a specially crafted Okular
archive, possibly allowing the writing of arbitrary files with the
privileges of the process.


Workaround

There is no known workaround at this time.

Resolution

All Okular users should upgrade to the latest version: