[ASA-201802-4] plasma-workspace: arbitrary command execution Arch Linux Security Advisory ASA-201802-4 ========================================= Severity: High Date : 2018-02-09 CVE-ID : CVE-2018-6791 Package : plasma-workspace Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-607 Summary ======= The package plasma-workspace before version 5.12.0-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 5.12.0-1. # pacman -Syu "plasma-workspace>=5.12.0-1" The problem has been fixed upstream in version 5.12.0. Workaround ========== Mount removable devices with Dolphin instead of the device notifier. Description =========== When a vfat thumbdrive which contains `` or $() in its volume label is plugged and mounted trough the device notifier, it's interpreted as a shell command, leaving a possibility of arbitrary commands execution. an example of offending volume label is "$(touch b)" which will create a file called b in the home folder. Impact ====== A local attacker is able to execute arbitrary commands on the affected system by inserting and mounting a specially crafted thumbdrive. References ========== https://www.kde.org/info/security/advisory-20180208-2.txt https://security.archlinux.org/CVE-2018-6791