Vulnerability CVE-2019-14744
Published: 2019-08-07

Description:
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

Type:

CWE-77

 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.1/10
6.4/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Debian -> Debian linux 

 References:
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html
http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html
https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt
https://lists.debian.org/debian-lts-announce/2019/08/msg00023.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/
https://seclists.org/bugtraq/2019/Aug/12
https://seclists.org/bugtraq/2019/Aug/9
https://security.gentoo.org/glsa/201908-07
https://usn.ubuntu.com/4100-1/
https://www.debian.org/security/2019/dsa-4494
https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/
Copyright 2024, cxsecurity.com

 

Back to Top