CVEvulnerability
CVE-2024-36041
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-07-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-613
Description
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.
Affected configurations
• kde plasma-workspace (< 5.27.11.1)
• kde plasma-workspace (>= 6.0.0.0 < 6.0.5.1)
Related
Weakness · not in database (1)
References
- https://github.com/KDE/plasma-workspace/tags Release Notes
- https://invent.kde.org/plasma/plasma-workspace/ Product
- https://kde.org/info/security/advisory-20240531-1.txt Vendor Advisory
- https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html Product
- https://github.com/KDE/plasma-workspace/tags Release Notes
- https://invent.kde.org/plasma/plasma-workspace/ Product
- https://kde.org/info/security/advisory-20240531-1.txt Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2024/06/msg00002.html lists.debian.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/43YGQJGB5I33UBRY2OHXTPXIEESZLZ6N/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DNOZWSWXAR6EM3VIUJRSAI3L4QPURQPC/ lists.fedoraproject.org
- https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html Product