CVE-2019-14744
Published: 7 August 2019
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
From the Ubuntu security team
It was discovered that KConfig and KDE libraries have a vulnerability where an attacker could hide malicious code under desktop and configuration files.
Priority
Medium
CVSS 3 base score: 7.8
Status
| Package | Release | Status |
|---|---|---|
|
kconfig Launchpad, Ubuntu, Debian |
bionic |
Released
(5.44.0-0ubuntu1.1)
|
| disco |
Released
(5.56.0-0ubuntu1.1)
|
|
| eoan |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| focal |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| groovy |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| hirsute |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| impish |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| jammy |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(5.18.0-0ubuntu1.1)
|
|
|
Patches: upstream: https://phabricator.kde.org/R237:5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 |
||
|
kde4libs Launchpad, Ubuntu, Debian |
bionic |
Released
(4:4.14.38-0ubuntu3.1)
|
| disco |
Released
(4:4.14.38-0ubuntu6.1)
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Needs triage
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(4:4.14.16-0ubuntu3.3)
|
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14744
- https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt
- https://kde.org/info/security/advisory-20190807-1.txt
- https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/
- https://phabricator.kde.org/D22979
- https://ubuntu.com/security/notices/USN-4100-1
- NVD
- Launchpad
- Debian