[CVE] Crash in IRC message parsing

[Simon Quigley]

KDE Project Security Advisory
=============================

Title: Konversation: Crash in IRC message parsing
Risk Rating: High
CVE: CVE-2017-15923
Versions: konversation <= 1.7.2
Date: 12 November 2017

Overview
========
Konversation has support for colors in IRC messages. Any malicious user connected to the
same IRC network can send a carefully crafted message that will crash the Konversation user client.

Workaround
==========
Go to Interface → Colors in the Configure Konversation dialog and uncheck Allow Colored Text in IRC Messages (near the bottom)

Solution
========
Update to Konversation > 1.7.2

Or apply the following patches:
1.7: https://cgit.kde.org/konversation.git/commit/?h=1.7&id=34cc9556c1a089fac6b674d3bd6f2248e9512902
1.6: https://cgit.kde.org/konversation.git/commit/?h=1.6&id=cebf8d7658b0e3afb0292c273704ec4d2ea4019f
1.5: https://cgit.kde.org/konversation.git/commit/?h=1.5&id=6a7f59ee1b9dbc6e5cf9e5f3b306504d02b73ef0
1.4: the patch for 1.5 will apply, but you should upgrade

Credits
=======
Thanks to Joseph Bisch for the report and to Eli MacKenzie for the fix.

[Simon Quigley (tsimonq2)]

Packages are available for testing in ppa:tsimonq2/security-builds and in ppa:kubuntu-ppa/backports-landing. More details are available here: https://lists.ubuntu.com/archives/kubuntu-devel/2017-November/011487.html

[Simon Quigley (tsimonq2)]

I uploaded debdiffs and dsc files with the patch applied here: http://people.ubuntu.com/~tsimonq2/.cves/konversation/

I have tested each package on each respective Kubuntu release, and they work without regresssions and fix the problem.

[Steve Beattie (sbeattie)]

Thanks Simon, I'm looking at these now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package konversation - 1.5-1ubuntu1.14.04.2

---------------
konversation (1.5-1ubuntu1.14.04.2) trusty-security; urgency=high

  * SECURITY UPDATE: Crash in IRC message parsing (LP: #1731797):
    - kubuntu_03_CVE-2017-15923.diff: ensure integer overflow has not
      happened
    - CVE-2017-15923
    - https://www.kde.org/info/security/advisory-20171112-1.txt

 -- Simon Quigley <email address hidden> Tue, 21 Nov 2017 15:11:10 -0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package konversation - 1.6.2-0ubuntu1.1

---------------
konversation (1.6.2-0ubuntu1.1) zesty-security; urgency=high

  * SECURITY UPDATE: Crash in IRC message parsing (LP: #1731797):
    - CVE-2017-15923.patch: ensure integer overflow has not happened
    - CVE-2017-15923
    - https://www.kde.org/info/security/advisory-20171112-1.txt

 -- Simon Quigley <email address hidden> Tue, 21 Nov 2017 14:23:02 -0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package konversation - 1.7.2-1ubuntu1.1

---------------
konversation (1.7.2-1ubuntu1.1) artful-security; urgency=high

  * SECURITY UPDATE: Crash in IRC message parsing (LP: #1731797):
    - CVE-2017-15923.patch: ensure integer overflow has not happened
    - CVE-2017-15923
    - https://www.kde.org/info/security/advisory-20171112-1.txt

 -- Simon Quigley <email address hidden> Tue, 21 Nov 2017 11:34:38 -0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package konversation - 1.6-0ubuntu1.1

---------------
konversation (1.6-0ubuntu1.1) xenial-security; urgency=high

  * SECURITY UPDATE: Crash in IRC message parsing (LP: #1731797):
    - CVE-2017-15923.patch: ensure integer overflow has not happened
    - CVE-2017-15923
    - https://www.kde.org/info/security/advisory-20171112-1.txt

 -- Simon Quigley <email address hidden> Tue, 21 Nov 2017 14:21:46 -0800

[Tyler Hicks (tyhicks)]

I'm unsubscribing ubuntu-security-sponsors since the archive updates have all been sponsored. Thanks!

[Simon Quigley (tsimonq2)]

Whoops, this was fixed in the PPA a while ago. Marking as such.