CVE-2019-14744

HIGH

KDE Kconfig < 5.61.0 - OS Command Injection

Title source: rule

Description

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

References (18)

[Mailing List, Patch, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html

[Mailing List, Patch, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html

[Patch, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2019:2606

[Exploit, Third Party Advisory] https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt

[Mailing List, Third Party Advisory] https://lists.debian.org/debian-lts-announce/2019/08/msg00023.html

[Mailing List, Third Party Advisory] https://seclists.org/bugtraq/2019/Aug/12

[Mailing List, Third Party Advisory] https://seclists.org/bugtraq/2019/Aug/9

[Third Party Advisory] https://security.gentoo.org/glsa/201908-07

[Third Party Advisory] https://usn.ubuntu.com/4100-1/

[Third Party Advisory] https://www.debian.org/security/2019/dsa-4494

[Press/Media Coverage, Third Party Advisory] https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/

Scores

CVSS v3 7.8

EPSS 0.0131

EPSS Percentile 79.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Classification

CWE

CWE-78

Status published

Affected Products (12)

kde/kconfig < 5.61.0

debian/debian_linux

debian/debian_linux

fedoraproject/fedora

fedoraproject/fedora

opensuse/backports_sle

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

redhat/enterprise_linux_desktop

redhat/enterprise_linux_server

redhat/enterprise_linux_workstation

Timeline

Published Aug 07, 2019

Tracked Since Feb 18, 2026