The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kateUpgrade ktexteditor | Jul 30, 2024 | Feb 11, 2022 |
| Gentoo Linux | — | Upgrade kde-frameworks/ktexteditor. | Jan 16, 2024 | Feb 11, 2022 |
| Suse | — | Upgrade libqt5core-devel-32bitUpgrade libqt5core5Upgrade libqt5-qtbase-private-headers-develUpgrade libqt5network5Upgrade libqt5sql5-unixodbc-32bitUpgrade libqt5concurrent5-32bitUpgrade libqt5platformsupport-devel-static-32bitUpgrade libqt5sql5-sqlite-32bitUpgrade libqt5dbus-devel-32bitUpgrade libqt5network5-32bitUpgrade libqt5sql5Upgrade libqt5-qtbase-common-develUpgrade libqt5gui5Upgrade libqt5concurrent-develUpgrade libqt5sql5-postgresqlUpgrade libqt5core-private-headers-develUpgrade libqt5gui-develUpgrade libqt5kmssupport-devel-staticUpgrade libqt5concurrent5Upgrade libqt5gui-devel-32bitUpgrade libqt5sql-devel-32bitUpgrade libqt5widgets-develUpgrade libqt5test-devel-32bitUpgrade kateUpgrade libqt5network-develUpgrade libqt5sql5-postgresql-32bitUpgrade libqt5platformheaders-develUpgrade libqt5opengl-develUpgrade libqt5bootstrap-devel-staticUpgrade libqt5opengl5Upgrade libqt5widgets-private-headers-develUpgrade libqt5-qtbase-platformtheme-gtk3Upgrade libqt5printsupport-develUpgrade libqt5openglextensions-devel-staticUpgrade libqt5printsupport-devel-32bitUpgrade libqt5dbus-develUpgrade libqt5widgets5Upgrade libqt5-qtbase-examplesUpgrade libqt5opengl5-32bitUpgrade libqt5opengl-private-headers-develUpgrade libqt5widgets-devel-32bitUpgrade libqt5core-develUpgrade libqt5core5-32bitUpgrade libqt5platformsupport-private-headers-develUpgrade libqt5dbus-private-headers-develUpgrade libqt5sql-private-headers-develUpgrade libqt5network-private-headers-develUpgrade libqt5sql-develUpgrade libqt5-qtbase-examples-32bitUpgrade libqt5test-private-headers-develUpgrade libqt5gui5-32bitUpgrade libqt5opengl-devel-32bitUpgrade libqt5printsupport-private-headers-develUpgrade libqt5sql5-sqliteUpgrade libqt5widgets5-32bitUpgrade libqt5sql5-mysql-32bitUpgrade libqt5platformsupport-devel-staticUpgrade libqt5test5Upgrade libqt5kmssupport-private-headers-develUpgrade libqt5openglextensions-devel-static-32bitUpgrade libqt5-qtbase-develUpgrade libqt5bootstrap-devel-static-32bitUpgrade libqt5printsupport5Upgrade libqt5concurrent-devel-32bitUpgrade libqt5test5-32bitUpgrade libqt5sql5-32bitUpgrade libqt5dbus5-32bitUpgrade libqt5xml-devel-32bitUpgrade libqt5test-develUpgrade libqt5xml5-32bitUpgrade libqt5network-devel-32bitUpgrade libqt5sql5-mysqlUpgrade libqt5-qtbase-platformtheme-xdgdesktopportalUpgrade kate-pluginsUpgrade kate-langUpgrade libqt5sql5-unixodbcUpgrade libqt5xml5Upgrade libqt5printsupport5-32bitUpgrade libqt5gui-private-headers-develUpgrade libqt5dbus5Upgrade libqt5xml-devel | Mar 16, 2022 | Feb 11, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub