In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kde-settings-plasmaUpgrade kdelibs-ktexteditorUpgrade kdelibsUpgrade kdelibs-debuginfoUpgrade kde-settings-ksplashUpgrade kdelibs-develUpgrade kde-settings-minimalUpgrade qt-settingsUpgrade kde-settingsUpgrade kdelibs-apidocsUpgrade kde-settings-pulseaudioUpgrade kdelibs-common | Sep 4, 2019 | Aug 7, 2019 |
| Debian | — | Upgrade kconfig | Aug 13, 2019 | Aug 7, 2019 |
| Freebsd | — | Upgrade kf5-kconfig | Aug 10, 2019 | Aug 9, 2019 |
| Gentoo Linux | — | Upgrade kde-frameworks/kconfig. | Aug 16, 2019 | Aug 7, 2019 |
| Oracle_linux | — | Upgrade kde-settingsUpgrade kde-settings-minimalUpgrade kdelibs-apidocsUpgrade kdelibsUpgrade kdelibs-commonUpgrade kde-settings-ksplashUpgrade qt-settingsUpgrade kde-settings-plasmaUpgrade kde-settings-pulseaudioUpgrade kdelibs-ktexteditorUpgrade kdelibs-devel | Sep 4, 2019 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade kdelibs-ktexteditorUpgrade kdelibs-apidocsUpgrade kdelibs-debuginfoUpgrade kde-settings-pulseaudioUpgrade kde-settings-plasmaUpgrade kde-settings-minimalUpgrade kdelibs-develUpgrade kde-settingsUpgrade kdelibs-commonUpgrade kdelibsUpgrade kde-settings-ksplashUpgrade qt-settings | Sep 4, 2019 | Aug 7, 2019 |
| Suse | — | Upgrade kconfig-develUpgrade libksuseinstall1Upgrade libkde4Upgrade kconfig-devel-64bitUpgrade libkde4-develUpgrade libkdecore4-32bitUpgrade kconf_update5Upgrade libKF5ConfigCore5-32bitUpgrade kdelibs4-apidocsUpgrade kdelibs4-docUpgrade libkdecore4-develUpgrade libKF5ConfigGui5Upgrade kconfig-devel-32bitUpgrade libKF5ConfigCore5-64bitUpgrade libKF5ConfigCore5Upgrade kdelibs4-coreUpgrade libkdecore4-64bitUpgrade libksuseinstall1-64bitUpgrade libKF5ConfigCore5-langUpgrade libkdecore4Upgrade libkde4-64bitUpgrade libkde4-32bitUpgrade kdelibs4-branding-upstreamUpgrade libKF5ConfigGui5-32bitUpgrade kdelibs4Upgrade libksuseinstall-develUpgrade libKF5ConfigGui5-64bitUpgrade libksuseinstall1-32bit | Aug 14, 2019 | Aug 7, 2019 |
| Ubuntu | — | Upgrade libkdecore5Upgrade libkf5configcore5 | Aug 20, 2019 | Aug 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub