Konversation contains multiple vulnerabilities that could lead to remote command execution or information leaks.
|Package||net-irc/konversation on all architectures|
|Affected versions||< 0.15.1|
|Unaffected versions||>= 0.15.1|
Konversation is a user-friendly IRC client for KDE.
Wouter Coekaerts has discovered three vulnerabilities within Konversation:
A malicious server could create specially-crafted channels, which would exploit certain flaws in Konversation, potentially leading to the execution of shell commands. A user could also unintentionally input their password into the 'Nick' field in the Quick Connect dialog, exposing his password to IRC users, and log files.
There is no known workaround at this time.
All Konversation users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-irc/konversation-0.15.1"
January 24, 2005
January 24, 2005: 01