CVEvulnerability
CVE-2014-2528
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-08-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Description
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
Affected configurations
• kdirstat project kdirstat 2.7.3
• opensuse opensuse 13.1
References
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/03/17/2 www.openwall.com
- http://www.openwall.com/lists/oss-security/2014/03/18/2 Patch
- https://bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa#chg-src/kcleanup.cpp Exploit, Patch
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659 bugs.debian.org
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/03/17/2 www.openwall.com
- http://www.openwall.com/lists/oss-security/2014/03/18/2 Patch
- https://bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa#chg-src/kcleanup.cpp Exploit, Patch
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659 bugs.debian.org