ISOMAN

CVE

CVE-2019-14744

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

Severity
HIGH
CVSS
7.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html
  2. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html
  3. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html
  4. http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html
  5. https://access.redhat.com/errata/RHSA-2019:2606
  6. https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt
  7. https://lists.debian.org/debian-lts-announce/2019/08/msg00023.html
  8. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/
  9. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/
  10. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/
  11. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/
  12. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/
  13. https://seclists.org/bugtraq/2019/Aug/12
  14. https://seclists.org/bugtraq/2019/Aug/9
  15. https://security.gentoo.org/glsa/201908-07
  16. https://usn.ubuntu.com/4100-1/
  17. https://www.debian.org/security/2019/dsa-4494
  18. https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/
  19. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html
  20. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html