CVE-2020-35605

Name	CVE-2020-35605
Description	The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4819-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
kitty (PTS)	bullseye	0.19.3-1	fixed
	bullseye (security)	0.19.3-1+deb11u1	fixed
	bookworm	0.26.5-5	fixed
	trixie	0.41.1-2	fixed
	forky, sid	0.43.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
kitty	source	buster	0.13.3-1+deb10u1		DSA-4819-1
kitty	source	(unstable)	0.19.3-1

https://github.com/kovidgoyal/kitty/commit/82c137878c2b99100a3cdc1c0f0efea069313901 (v0.19.3)
https://github.com/kovidgoyal/kitty/issues/3128