CVE-2019-7443

moderate-risk

Published 2019-05-07

KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.

Do I need to act?

3.7% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (6)

Kauth

Leap

Backports

Fedora

Affected Vendors

Kde Fedoraproject Opensuse

References (12)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00060.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00065.html

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1124863

Patch https://cgit.kde.org/kauth.git/commit/?id=fc70fb0161c1b9144d26389434d34dd135cd3f...

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00060.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-02/msg00065.html

Issue Tracking https://bugzilla.suse.com/show_bug.cgi?id=1124863

Patch https://cgit.kde.org/kauth.git/commit/?id=fc70fb0161c1b9144d26389434d34dd135cd3f...

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 7/34 · Low

Exposure 13/34 · Low