In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kde-settings-plasmaUpgrade kde-settings-minimalUpgrade kdelibs-develUpgrade kdelibsUpgrade kdelibs-debuginfoUpgrade kde-settings-ksplashUpgrade kdelibs-ktexteditorUpgrade kdelibs-apidocsUpgrade kde-settingsUpgrade qt-settingsUpgrade kde-settings-pulseaudioUpgrade kdelibs-common | Sep 4, 2019 | Aug 7, 2019 |
| Debian | — | Upgrade kconfig | Aug 13, 2019 | Aug 7, 2019 |
| Freebsd | — | Upgrade kf5-kconfig | Aug 10, 2019 | Aug 9, 2019 |
| Gentoo Linux | — | Upgrade kde-frameworks/kconfig. | Aug 16, 2019 | Aug 7, 2019 |
| Oracle_linux | — | Upgrade kde-settingsUpgrade kdelibs-commonUpgrade kde-settings-ksplashUpgrade kde-settings-minimalUpgrade kdelibsUpgrade kdelibs-apidocsUpgrade qt-settingsUpgrade kde-settings-plasmaUpgrade kdelibs-develUpgrade kde-settings-pulseaudioUpgrade kdelibs-ktexteditor | Sep 4, 2019 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade kde-settings-minimalUpgrade kdelibs-debuginfoUpgrade kde-settings-pulseaudioUpgrade kdelibs-ktexteditorUpgrade kde-settings-plasmaUpgrade kdelibs-apidocsUpgrade kdelibsUpgrade kde-settingsUpgrade kdelibs-commonUpgrade qt-settingsUpgrade kdelibs-develUpgrade kde-settings-ksplash | Sep 4, 2019 | Aug 7, 2019 |
| Suse | — | Upgrade libkdecore4-64bitUpgrade libKF5ConfigCore5-64bitUpgrade libKF5ConfigCore5Upgrade libksuseinstall1-32bitUpgrade libksuseinstall1-64bitUpgrade kdelibs4-coreUpgrade libKF5ConfigCore5-langUpgrade libksuseinstall-develUpgrade libkde4-32bitUpgrade kdelibs4Upgrade kconfig-devel-32bitUpgrade libkde4-64bitUpgrade libkdecore4Upgrade libKF5ConfigGui5-32bitUpgrade kdelibs4-branding-upstreamUpgrade libKF5ConfigGui5-64bitUpgrade kconf_update5Upgrade libKF5ConfigCore5-32bitUpgrade kdelibs4-apidocsUpgrade libkde4-develUpgrade kdelibs4-docUpgrade libkdecore4-32bitUpgrade kconfig-devel-64bitUpgrade kconfig-develUpgrade libkdecore4-develUpgrade libkde4Upgrade libksuseinstall1Upgrade libKF5ConfigGui5 | Aug 14, 2019 | Aug 7, 2019 |
| Ubuntu | — | Upgrade libkf5configcore5Upgrade libkdecore5 | Aug 20, 2019 | Aug 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub