CVEvulnerability

CVE-2019-7443

8.1 HIGH Published 2019-05-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-05-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20

Description

KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.

Affected configurations

• kde kauth (< 5.55.0) • opensuse leap 15.0 • opensuse leap 42.3 • opensuse backports • fedoraproject fedora 28 • fedoraproject fedora 29

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References