In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kde-settings-pulseaudioUpgrade kdelibs-commonUpgrade kdelibs-apidocsUpgrade kde-settingsUpgrade qt-settingsUpgrade kdelibs-debuginfoUpgrade kdelibs-ktexteditorUpgrade kdelibsUpgrade kde-settings-ksplashUpgrade kdelibs-develUpgrade kde-settings-plasmaUpgrade kde-settings-minimal | Sep 4, 2019 | Aug 7, 2019 |
| Debian | — | Upgrade kconfig | Aug 13, 2019 | Aug 7, 2019 |
| Freebsd | — | Upgrade kf5-kconfig | Aug 10, 2019 | Aug 9, 2019 |
| Gentoo Linux | — | Upgrade kde-frameworks/kconfig. | Aug 16, 2019 | Aug 7, 2019 |
| Oracle_linux | — | Upgrade kde-settings-pulseaudioUpgrade kdelibs-develUpgrade kdelibs-ktexteditorUpgrade qt-settingsUpgrade kde-settings-plasmaUpgrade kdelibs-apidocsUpgrade kdelibsUpgrade kde-settings-minimalUpgrade kde-settings-ksplashUpgrade kdelibs-commonUpgrade kde-settings | Sep 4, 2019 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade kde-settings-plasmaUpgrade kde-settings-pulseaudioUpgrade kdelibs-apidocsUpgrade kdelibs-debuginfoUpgrade kde-settings-minimalUpgrade kdelibs-ktexteditorUpgrade kdelibs-develUpgrade kde-settingsUpgrade kdelibsUpgrade qt-settingsUpgrade kde-settings-ksplashUpgrade kdelibs-common | Sep 4, 2019 | Aug 7, 2019 |
| Suse | — | Upgrade libksuseinstall1Upgrade libKF5ConfigGui5Upgrade kdelibs4-apidocsUpgrade libkdecore4-develUpgrade libKF5ConfigCore5-32bitUpgrade libkde4-develUpgrade libkde4Upgrade kconfig-devel-64bitUpgrade kconfig-develUpgrade kconf_update5Upgrade kdelibs4-docUpgrade libkdecore4-32bitUpgrade libkde4-64bitUpgrade libKF5ConfigGui5-32bitUpgrade libksuseinstall1-64bitUpgrade libksuseinstall-develUpgrade libkde4-32bitUpgrade libksuseinstall1-32bitUpgrade kdelibs4-branding-upstreamUpgrade libKF5ConfigCore5-langUpgrade libkdecore4-64bitUpgrade libkdecore4Upgrade kdelibs4Upgrade kconfig-devel-32bitUpgrade libKF5ConfigCore5-64bitUpgrade libKF5ConfigCore5Upgrade libKF5ConfigGui5-64bitUpgrade kdelibs4-core | Aug 14, 2019 | Aug 7, 2019 |
| Ubuntu | — | Upgrade libkf5configcore5Upgrade libkdecore5 | Aug 20, 2019 | Aug 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub