Felix Geyer

**Name of the Vulnerable Software and Affected Versions** Ubuntu versions 11.04 through 12.04 LTS **Description** The issue allows remote attackers to read repository credentials by viewing a public bug report, due to the Apport hook in Update Manager uploading certain system state archive files when reporting bugs to Launchpad. **Recommendations** For Ubuntu versions 11.04 through 12.04 LTS, consider restricting access to the bug reporting feature in Launchpad to minimize the risk of exploitation. As a temporary workaround, avoid using the Apport hook in Update Manager until a patch is available.

**Name of the Vulnerable Software and Affected Versions** KDE SC versions 4.6.2 and earlier kdenetwork versions 4.3.4 kdenetwork-devel versions 4.3.4 kdenetwork-debuginfo versions 4.3.4 kdenetwork-libs versions 4.3.4 **Description** The issue is related to a directory traversal vulnerability in the KGetMetalink::File::isValidNameAttr function, which can be exploited remotely. This vulnerability allows remote attackers to create arbitrary files via a .. (dot dot) in the name attribute of a file element in a metalink file. The vulnerability exists due to an incomplete fix for a previous issue. Exploitation of this vulnerability can lead to a violation of the integrity and availability of protected information. **Recommendations** For KDE SC versions 4.6.2 and earlier, consider updating to a newer version to resolve the issue. For kdenetwork versions 4.3.4, kdenetwork-devel versions 4.3.4, kdenetwork-debuginfo versions 4.3.4, and kdenetwork-libs versions 4.3.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.