In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kdelibsUpgrade kdelibs-debuginfoUpgrade kdelibs-develUpgrade kde-settings-plasmaUpgrade kdelibs-ktexteditorUpgrade kde-settings-ksplashUpgrade kde-settings-minimalUpgrade kde-settingsUpgrade kdelibs-apidocsUpgrade kde-settings-pulseaudioUpgrade qt-settingsUpgrade kdelibs-common | Sep 4, 2019 | Aug 7, 2019 |
| Debian | — | Upgrade kconfig | Aug 13, 2019 | Aug 7, 2019 |
| Freebsd | — | Upgrade kf5-kconfig | Aug 10, 2019 | Aug 9, 2019 |
| Gentoo Linux | — | Upgrade kde-frameworks/kconfig. | Aug 16, 2019 | Aug 7, 2019 |
| Oracle_linux | — | Upgrade kdelibs-develUpgrade kde-settings-pulseaudioUpgrade qt-settingsUpgrade kde-settings-plasmaUpgrade kdelibs-ktexteditorUpgrade kde-settings-minimalUpgrade kdelibsUpgrade kde-settings-ksplashUpgrade kdelibs-commonUpgrade kde-settingsUpgrade kdelibs-apidocs | Sep 4, 2019 | Aug 12, 2019 |
| Redhat_linux | — | Upgrade qt-settingsUpgrade kdelibs-develUpgrade kdelibs-commonUpgrade kde-settings-ksplashUpgrade kde-settingsUpgrade kdelibsUpgrade kdelibs-ktexteditorUpgrade kde-settings-minimalUpgrade kde-settings-pulseaudioUpgrade kdelibs-apidocsUpgrade kdelibs-debuginfoUpgrade kde-settings-plasma | Sep 4, 2019 | Aug 7, 2019 |
| Suse | — | Upgrade kdelibs4-docUpgrade libkde4Upgrade kconfig-devel-64bitUpgrade libkdecore4-develUpgrade kconfig-develUpgrade libksuseinstall1Upgrade libKF5ConfigCore5-32bitUpgrade libKF5ConfigGui5Upgrade kconf_update5Upgrade libkdecore4-32bitUpgrade libkde4-develUpgrade kdelibs4-apidocsUpgrade kconfig-devel-32bitUpgrade libKF5ConfigCore5-64bitUpgrade libKF5ConfigCore5Upgrade libkdecore4-64bitUpgrade libkdecore4Upgrade libKF5ConfigCore5-langUpgrade libkde4-32bitUpgrade libksuseinstall-develUpgrade kdelibs4-coreUpgrade libKF5ConfigGui5-64bitUpgrade libksuseinstall1-64bitUpgrade libksuseinstall1-32bitUpgrade libkde4-64bitUpgrade libKF5ConfigGui5-32bitUpgrade kdelibs4-branding-upstreamUpgrade kdelibs4 | Aug 14, 2019 | Aug 7, 2019 |
| Ubuntu | — | Upgrade libkdecore5Upgrade libkf5configcore5 | Aug 20, 2019 | Aug 7, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub