CVE-2019-7443
Published: 7 May 2019
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
kauth Launchpad, Ubuntu, Debian |
bionic |
Released
(5.44.0-0ubuntu1+esm1)
Available with Ubuntu Pro |
| cosmic |
Ignored
(end of life)
|
|
| disco |
Ignored
(end of life)
|
|
| eoan |
Ignored
(end of life)
|
|
| focal |
Not vulnerable
(5.68.0-0ubuntu1)
|
|
| groovy |
Ignored
(end of life)
|
|
| hirsute |
Ignored
(end of life)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Not vulnerable
(5.92.0)
|
|
| kinetic |
Not vulnerable
(5.92.0)
|
|
| lunar |
Not vulnerable
(5.98.0-0ubuntu1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(5.54.0-2)
|
|
| xenial |
Released
(5.18.0-0ubuntu2+esm1)
Available with Ubuntu Pro |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.1 |
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |