CVE-2019-14744

HIGH

KDE KConfig < 5.61.0 - OS Command Injection via Malicious Desktop Files

Title source: llm

Description

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

References (18)

Core 18

Core References

Exploit, Third Party Advisory x_refsource_misc

https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt

Press/Media Coverage, Third Party Advisory x_refsource_misc

https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/

Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq

https://seclists.org/bugtraq/2019/Aug/9

Patch, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2019/dsa-4494

Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq

https://seclists.org/bugtraq/2019/Aug/12

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/

Mailing List, Patch, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html

Mailing List, Patch, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201908-07

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2019/08/msg00023.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/

Third Party Advisory vendor-advisory x_refsource_ubuntu

https://usn.ubuntu.com/4100-1/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/

Third Party Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2019:2606

Scores

CVSS v3 7.8

EPSS 0.0128

EPSS Percentile 79.9%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (12)

canonical/ubuntu_linux 16.04

canonical/ubuntu_linux 18.04

canonical/ubuntu_linux 19.04

debian/debian_linux 9.0

debian/debian_linux 10.0

fedoraproject/fedora 29

fedoraproject/fedora 30

kde/kconfig < 5.61.0

opensuse/backports_sle 15.0 sp1

redhat/enterprise_linux_desktop 7.0

... and 2 more

Published Aug 07, 2019

Tracked Since Feb 18, 2026