CVE-2019-14744
Published: 7 August 2019
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
From the Ubuntu Security Team
It was discovered that KConfig and KDE libraries have a vulnerability where an attacker could hide malicious code under desktop and configuration files.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
kconfig Launchpad, Ubuntu, Debian |
hirsute |
Not vulnerable
(5.60.0-0ubuntu2)
|
| jammy |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| bionic |
Released
(5.44.0-0ubuntu1.1)
|
|
| disco |
Released
(5.56.0-0ubuntu1.1)
|
|
| eoan |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| focal |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| groovy |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| impish |
Not vulnerable
(5.60.0-0ubuntu2)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(5.18.0-0ubuntu1.1)
|
|
|
Patches: upstream: https://phabricator.kde.org/R237:5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 |
||
|
kde4libs Launchpad, Ubuntu, Debian |
hirsute |
Does not exist
|
| jammy |
Does not exist
|
|
| trusty |
Released
(4:4.13.3-0ubuntu0.5+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| bionic |
Released
(4:4.14.38-0ubuntu3.1)
|
|
| disco |
Released
(4:4.14.38-0ubuntu6.1)
|
|
| eoan |
Does not exist
|
|
| focal |
Does not exist
|
|
| groovy |
Does not exist
|
|
| impish |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(4:4.14.16-0ubuntu3.3)
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.8 |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14744
- https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt
- https://kde.org/info/security/advisory-20190807-1.txt
- https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/
- https://phabricator.kde.org/D22979
- https://ubuntu.com/security/notices/USN-4100-1
- NVD
- Launchpad
- Debian