CVE request: kdirstat, insufficient quote escaping leading to arbitrary command execution

[Murray McAllister <mmcallis () redhat com>]

Good morning,

Adrian Panasiuk discovered that the KDirStat (KDE Directory Statistics) 
tool did not correctly escape quotes when deleting a directory 
permanently. Attempting to use KDirStat to permanently delete a 
directory that has a malicious name could result in arbitrary command 
execution.

Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659

The Debian report is about single quotes. On Fedora 
(https://bugzilla.redhat.com/show_bug.cgi?id=1077059) double quotes were 
needed.

Can a CVE please be assigned if one has not been already? (And maybe it 
should be escaping ';' too if not already?)

Thanks,

--
Murray McAllister / Red Hat Security Response Team