In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kde-settings-plasmaUpgrade kdelibs-ktexteditorUpgrade kde-settings-minimalUpgrade kde-settings-ksplashUpgrade kdelibs-develUpgrade kdelibsUpgrade kdelibs-debuginfoUpgrade kde-settings-pulseaudioUpgrade kdelibs-apidocsUpgrade qt-settingsUpgrade kde-settingsUpgrade kdelibs-common | Sep 4, 2019 | Aug 7, 2019 |
| Debian | — | Upgrade kconfig | Aug 13, 2019 | Aug 7, 2019 |
| Freebsd | — | Upgrade kf5-kconfig | Aug 10, 2019 | Aug 9, 2019 |
| Gentoo Linux | — | Upgrade kde-frameworks/kconfig. | Aug 16, 2019 | Aug 7, 2019 |
| Oracle_linux | — | Upgrade kde-settings-minimalUpgrade kdelibsUpgrade kde-settingsUpgrade kdelibs-commonUpgrade kde-settings-ksplashUpgrade kdelibs-apidocsUpgrade qt-settingsUpgrade kdelibs-develUpgrade kde-settings-pulseaudioUpgrade kdelibs-ktexteditorUpgrade kde-settings-plasma | Sep 4, 2019 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade kdelibs-ktexteditorUpgrade kdelibs-apidocsUpgrade kde-settings-pulseaudioUpgrade kdelibs-debuginfoUpgrade kde-settings-minimalUpgrade kde-settings-plasmaUpgrade qt-settingsUpgrade kdelibsUpgrade kdelibs-develUpgrade kdelibs-commonUpgrade kde-settings-ksplashUpgrade kde-settings | Sep 4, 2019 | Aug 7, 2019 |
| Suse | — | Upgrade libKF5ConfigGui5-64bitUpgrade libKF5ConfigCore5-langUpgrade libksuseinstall1-64bitUpgrade kconfig-devel-32bitUpgrade libKF5ConfigCore5Upgrade kdelibs4-coreUpgrade libKF5ConfigCore5-64bitUpgrade kdelibs4Upgrade libkde4-32bitUpgrade libKF5ConfigGui5-32bitUpgrade libkdecore4-64bitUpgrade libkdecore4Upgrade libksuseinstall-develUpgrade kdelibs4-branding-upstreamUpgrade libksuseinstall1-32bitUpgrade libkde4-64bitUpgrade libkdecore4-32bitUpgrade libkde4Upgrade libkdecore4-develUpgrade kdelibs4-apidocsUpgrade kconfig-develUpgrade libKF5ConfigGui5Upgrade libkde4-develUpgrade kconf_update5Upgrade kconfig-devel-64bitUpgrade libksuseinstall1Upgrade libKF5ConfigCore5-32bitUpgrade kdelibs4-doc | Aug 14, 2019 | Aug 7, 2019 |
| Ubuntu | — | Upgrade libkdecore5Upgrade libkf5configcore5 | Aug 20, 2019 | Aug 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub