KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade plasma-workspace | Aug 22, 2024 | Jul 5, 2024 |
| Debian | — | Upgrade plasma-workspace | Jun 17, 2024 | Jun 17, 2024 |
| Freebsd | — | Upgrade plasma5-plasma-workspaceUpgrade plasma6-plasma-workspace | Dec 10, 2025 | Jun 11, 2024 |
| Gentoo Linux | — | Upgrade kde-plasma/plasma-workspace. | Jul 9, 2024 | Jul 5, 2024 |
| Suse | — | Upgrade plasma5-workspace-develUpgrade plasma5-session-waylandUpgrade xembedsniproxyUpgrade gmenudbusmenuproxyUpgrade plasma5-workspaceUpgrade plasma5-workspace-libsUpgrade plasma5-workspace-langUpgrade plasma5-session | Jun 7, 2024 | Jun 7, 2024 |
| Ubuntu | — | Upgrade plasma-workspace | Jul 15, 2024 | Jul 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub