In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kdelibs-develUpgrade kde-settings-minimalUpgrade kdelibsUpgrade kde-settings-ksplashUpgrade kdelibs-ktexteditorUpgrade kde-settings-plasmaUpgrade kdelibs-debuginfoUpgrade qt-settingsUpgrade kdelibs-commonUpgrade kde-settings-pulseaudioUpgrade kde-settingsUpgrade kdelibs-apidocs | Sep 4, 2019 | Aug 7, 2019 |
| Debian | — | Upgrade kconfig | Aug 13, 2019 | Aug 7, 2019 |
| Freebsd | — | Upgrade kf5-kconfig | Aug 10, 2019 | Aug 9, 2019 |
| Gentoo Linux | — | Upgrade kde-frameworks/kconfig. | Aug 16, 2019 | Aug 7, 2019 |
| Oracle_linux | — | Upgrade kdelibs-ktexteditorUpgrade kdelibs-develUpgrade qt-settingsUpgrade kde-settings-plasmaUpgrade kde-settings-pulseaudioUpgrade kdelibsUpgrade kde-settings-ksplashUpgrade kdelibs-commonUpgrade kde-settingsUpgrade kde-settings-minimalUpgrade kdelibs-apidocs | Sep 4, 2019 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade kdelibsUpgrade kde-settings-ksplashUpgrade kde-settingsUpgrade kdelibs-develUpgrade kdelibs-commonUpgrade qt-settingsUpgrade kdelibs-apidocsUpgrade kde-settings-plasmaUpgrade kdelibs-debuginfoUpgrade kde-settings-pulseaudioUpgrade kde-settings-minimalUpgrade kdelibs-ktexteditor | Sep 4, 2019 | Aug 7, 2019 |
| Suse | — | Upgrade libkde4-32bitUpgrade libksuseinstall1-32bitUpgrade kdelibs4-branding-upstreamUpgrade libKF5ConfigGui5-64bitUpgrade libKF5ConfigGui5-32bitUpgrade libkde4-64bitUpgrade kdelibs4Upgrade libksuseinstall1-64bitUpgrade libksuseinstall-develUpgrade libkdecore4-64bitUpgrade libkdecore4Upgrade kconfig-devel-32bitUpgrade libKF5ConfigCore5-langUpgrade libKF5ConfigCore5-64bitUpgrade kdelibs4-coreUpgrade libKF5ConfigCore5Upgrade kdelibs4-docUpgrade kconf_update5Upgrade libkdecore4-develUpgrade libkdecore4-32bitUpgrade libkde4-develUpgrade libKF5ConfigGui5Upgrade kconfig-develUpgrade libkde4Upgrade kconfig-devel-64bitUpgrade kdelibs4-apidocsUpgrade libksuseinstall1Upgrade libKF5ConfigCore5-32bit | Aug 14, 2019 | Aug 7, 2019 |
| Ubuntu | — | Upgrade libkdecore5Upgrade libkf5configcore5 | Aug 20, 2019 | Aug 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub