As you may have been made aware on some news articles, blogs, and social media posts, a vulnerability to the KDE Plasma desktop was recently disclosed publicly. This occurred without KDE developers/security team or distributions being informed of the discovered vulnerability, or being given any advance notice of the disclosure.
KDE have responded quickly and responsibly and have now issued an advisory with a ‘fix’ [1].
Kubuntu is now working on applying this fix to our packages.
Packages in the Ubuntu main archive are having updates prepared [2], which will require a period of review before being released.
Consequently if users wish to get fixed packages sooner, packages with the patches applied have been made available in out PPAs.
Users of Xenial (out of support, but we have provided a patched package anyway), Bionic and Disco can get the updates as follows:
If you have our backports PPA [3] enabled:
The fixed packages are now in that PPA, so all is required is to update your system by your normal preferred method.
If you do NOT have our backports PPA enabled:
The fixed packages are provided in our UPDATES PPA [4].
sudo add-apt-repository ppa:kubuntu-ppa/ppa
sudo apt update
sudo apt full-upgrade
As a precaution to ensure that the update is picked up by all KDE processes, after updating their system users should at the very least log out and in again to restart their entire desktop session.
Regards
Kubuntu Team
[1] – https://kde.org/info/security/advisory-20190807-1.txt
[2] – https://bugs.launchpad.net/ubuntu/+source/kconfig/+bug/1839432
[3] – https://launchpad.net/~kubuntu-ppa/+archive/ubuntu/backports
[4] – https://launchpad.net/~kubuntu-ppa/+archive/ubuntu/ppa