In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kdelibsUpgrade kdelibs-ktexteditorUpgrade kde-settings-minimalUpgrade kde-settings-plasmaUpgrade kde-settings-ksplashUpgrade kdelibs-develUpgrade kdelibs-debuginfoUpgrade kde-settingsUpgrade kdelibs-commonUpgrade kdelibs-apidocsUpgrade qt-settingsUpgrade kde-settings-pulseaudio | Sep 4, 2019 | Aug 7, 2019 |
| Debian | — | Upgrade kconfig | Aug 13, 2019 | Aug 7, 2019 |
| Freebsd | — | Upgrade kf5-kconfig | Aug 10, 2019 | Aug 9, 2019 |
| Gentoo Linux | — | Upgrade kde-frameworks/kconfig. | Aug 16, 2019 | Aug 7, 2019 |
| Oracle_linux | — | Upgrade qt-settingsUpgrade kde-settings-pulseaudioUpgrade kdelibs-ktexteditorUpgrade kdelibs-develUpgrade kde-settings-plasmaUpgrade kdelibsUpgrade kdelibs-commonUpgrade kde-settings-ksplashUpgrade kde-settingsUpgrade kdelibs-apidocsUpgrade kde-settings-minimal | Sep 4, 2019 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade kdelibs-ktexteditorUpgrade kde-settings-minimalUpgrade kde-settings-plasmaUpgrade kde-settings-pulseaudioUpgrade kdelibs-apidocsUpgrade kdelibs-debuginfoUpgrade kde-settingsUpgrade qt-settingsUpgrade kdelibsUpgrade kdelibs-commonUpgrade kde-settings-ksplashUpgrade kdelibs-devel | Sep 4, 2019 | Aug 7, 2019 |
| Suse | — | Upgrade libKF5ConfigGui5-64bitUpgrade libksuseinstall1-32bitUpgrade libKF5ConfigCore5Upgrade libksuseinstall1-64bitUpgrade libkdecore4-64bitUpgrade kdelibs4-coreUpgrade libkdecore4Upgrade libKF5ConfigCore5-64bitUpgrade libKF5ConfigCore5-langUpgrade kconfig-devel-32bitUpgrade libKF5ConfigGui5-32bitUpgrade kdelibs4-branding-upstreamUpgrade libkde4-64bitUpgrade libkde4-32bitUpgrade kdelibs4Upgrade libksuseinstall-develUpgrade libkde4Upgrade kconfig-devel-64bitUpgrade libkde4-develUpgrade libkdecore4-develUpgrade libKF5ConfigCore5-32bitUpgrade libKF5ConfigGui5Upgrade libkdecore4-32bitUpgrade kconf_update5Upgrade kdelibs4-docUpgrade kconfig-develUpgrade kdelibs4-apidocsUpgrade libksuseinstall1 | Aug 14, 2019 | Aug 7, 2019 |
| Ubuntu | — | Upgrade libkf5configcore5Upgrade libkdecore5 | Aug 20, 2019 | Aug 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub