Headline
Ubuntu Security Notice USN-5659-1
Ubuntu Security Notice 5659-1 - Stephane Chauveau discovered that kitty incorrectly handled image filenames with special characters in error messages. A remote attacker could possibly use this to execute arbitrary commands. This issue only affected Ubuntu 20.04 LTS. Carter Sande discovered that kitty incorrectly handled escape sequences in desktop notifications. A remote attacker could possibly use this to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS.
==========================================================================Ubuntu Security Notice USN-5659-1October 05, 2022kitty vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 22.04 LTS- Ubuntu 20.04 LTSSummary:kitty could be made to run programs if it opened a speciallycrafted image or desktop notification.Software Description:- kitty: fast, featureful, GPU based terminal emulatorDetails:Stephane Chauveau discovered that kitty incorrectly handled imagefilenames with special characters in error messages. A remoteattacker could possibly use this to execute arbitrary commands.This issue only affected Ubuntu 20.04 LTS. (CVE-2020-35605)Carter Sande discovered that kitty incorrectly handled escapesequences in desktop notifications. A remote attacker could possiblyuse this to execute arbitrary commands. This issue only affectedUbuntu 22.04 LTS. (CVE-2022-41322)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 22.04 LTS:kitty 0.21.2-1ubuntu0.22.04.1Ubuntu 20.04 LTS:kitty 0.15.0-1ubuntu0.2In general, a standard system update will make all the necessary changes.References:https://ubuntu.com/security/notices/USN-5659-1CVE-2020-35605, CVE-2022-41322Package Information:https://launchpad.net/ubuntu/+source/kitty/0.21.2-1ubuntu0.22.04.1https://launchpad.net/ubuntu/+source/kitty/0.15.0-1ubuntu0.2Related news
An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.
Gentoo Linux Security Advisory 202209-22 - A vulnerability has been found in Kitty which could allow for arbitrary code execution with user input. Versions less than 0.26.2 are affected.
In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup.
The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.