Konversation 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 allow remote attackers to cause a denial of service (crash) via vectors related to parsing of IRC color formatting codes.

Latest stable release, includes security fix for CVE-2017-15923 see also &#xFFFC;https://konversation.kde.org/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for konversation fixes the following issues :

Security issue fixed :

  - CVE-2017-15923: Fixed a crash in parsing IRC color     formatting codes (boo#1068097).

Bug fixes :

  - Update to version 1.7.4 :

  - Fixed a bug causing the size of a custom chat text view     font set via the configuration dialog to be ignored. A     font size modification done via the Enlarge/Decrease     Font Size actions is now applied on top of the     configured size (or the system default font size,     respectively).

  - Update to 1.7.3 :

  - Added a copy action to the context menu of nicknames in     the chat text view.

  - Re-enabled channel mode buttons.

  - Reduced emission of Unicode directional control     characters in the chat text view. Unnecessary control     characters could sometimes cause problems with copying     text from Konversation and pasting it into terminal     applications, confusing them.

  - Fixed handling of nick and channel prefix characters     potentially using the same set of symbols.

  - Removed redundant escaping of angle brackets in GECOS     ('realname') field.

  - The nickname combobox will no longer change the nickname     to the current value whenvever it loses focus.

  - Fixed color scheme handling in the treelist version on     the tab bar, fixing an issue where the background and     text color of the selected item would sometimes be the     same, rendering the item unreadable.

  - Fixed handling of IRC URLs for channels starting with     more than one #, addressing a percent-encoding problem     with bookmarks of them.

  - Fixed custom chat text view font family reverting to     system default font family upon using the     increase/decrease font size actions.

  - Fixed chat text view font size adjusted via the     increase/decrease font size actions reverting to     configuration default when OK'ing the config dialog.

  - Fixed incorrect checkbox states in the Channel Invite     dialog.

  - Fixed a crash in IRC v3 extended-join parsing.

  - Fixed a crash in parsing IRC color formatting codes.

  - Fixed a minor memory leak in the Join Channel dialog     code.

  - Removed unnecessary nickname list debug message sent as     warning.

  - Trim description from redundant phrasing, and ensure     neutrality.

This update for konversation fixes the following issues :

Security issue fixed :

  - CVE-2017-15923: Fix a crash in parsing IRC color     formatting codes (boo#1068097).

It was discovered that there was a denial of service vulnerability in the konversation IRC client related to parsing of color formatting codes.

For Debian 7 'Wheezy', this issue has been fixed in konversation version 1.4-1+deb7u2.

We recommend that you upgrade your konversation packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Joseph Bisch discovered that Konversation, an user friendly Internet Relay Chat (IRC) client for KDE, could crash when parsing certain IRC color formatting codes.

KDE reports :

Konversation has support for colors in IRC messages. Any malicious user connected to the same IRC network can send a carefully crafted message that will crash the Konversation user client.

ID	Name	Product	Family	Severity
105921	Fedora 27 : konversation (2017-87142683f1)	Nessus	Fedora Local Security Checks	high
104834	Fedora 25 : konversation (2017-f58bbbbdb0)	Nessus	Fedora Local Security Checks	high
104822	Fedora 26 : konversation (2017-1f52998c8b)	Nessus	Fedora Local Security Checks	high
104769	openSUSE Security Update : konversation (openSUSE-2017-1306)	Nessus	SuSE Local Security Checks	high
104768	openSUSE Security Update : konversation (openSUSE-2017-1305)	Nessus	SuSE Local Security Checks	high
104677	Debian DLA-1174-1 : konversation security update	Nessus	Debian Local Security Checks	high
104535	Debian DSA-4033-1 : konversation - security update	Nessus	Debian Local Security Checks	high
104507	FreeBSD : konversation -- crash in IRC message parsing (795ccee1-c7ed-11e7-ad7d-001e2a3f778d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-15923

high

Tenable Plugins

high

high

high

high

high

high

high

high