CVEvulnerability
CVE-2019-14744
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-78
Description
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
Affected configurations
• kde kconfig (< 5.61.0)
• debian debian linux 9.0
• debian debian linux 10.0
• fedoraproject fedora 29
• fedoraproject fedora 30
• opensuse backports sle 15.0
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 7.0
• redhat enterprise linux workstation 7.0
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html Mailing List, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html Mailing List, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html Patch, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2606 Third Party Advisory
- https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00023.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Aug/12 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Aug/9 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201908-07 Third Party Advisory
- https://usn.ubuntu.com/4100-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4494 Third Party Advisory
- https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/ Press/Media Coverage, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html Mailing List, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html Mailing List, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html Patch, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2019:2606 Third Party Advisory
- https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00023.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/ lists.fedoraproject.org
- https://seclists.org/bugtraq/2019/Aug/12 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Aug/9 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201908-07 Third Party Advisory
- https://usn.ubuntu.com/4100-1/ Third Party Advisory
- https://www.debian.org/security/2019/dsa-4494 Third Party Advisory
- https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/ Press/Media Coverage, Third Party Advisory