CVE-2014-2528: Medium severity kdirstat vulnerability
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2528?
CVE-2014-2528 is considered a high severity vulnerability due to the potential for remote command execution.
How do I fix CVE-2014-2528?
To fix CVE-2014-2528, users should upgrade KDirStat to version 2.7.4 or later, which addresses the quoting issue.
What software is affected by CVE-2014-2528?
CVE-2014-2528 affects KDirStat version 2.7.3 and openSUSE 13.1.
What type of attack does CVE-2014-2528 enable?
CVE-2014-2528 enables remote attackers to execute arbitrary commands by exploiting unquoted strings in directory names.
Is CVE-2014-2528 related to CVE-2014-2527?
CVE-2014-2528 is a different vulnerability from CVE-2014-2527, each with its own exploitation method.