CVE-2018-10361: High severity kde ktexteditor vulnerability
An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's kauthktexteditorhelper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to gain root privileges. The attack occurs when one user (who has an unprivileged account but is also able to authenticate as root) writes a text file using Kate into a directory owned by a another unprivileged user. The latter unprivileged user conducts a symlink attack to achieve privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-10361.
What is the severity of CVE-2018-10361?
The severity of CVE-2018-10361 is high with a CVSS score of 7.8.
What software is affected by CVE-2018-10361?
KTextEditor versions 5.34.0 through 5.45.0 are affected by CVE-2018-10361.
How can an attacker exploit CVE-2018-10361?
By leveraging insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service, an attacker can gain root privileges on the local system.
Are there any references for CVE-2018-10361?
Yes, you can find references for CVE-2018-10361 at the following URLs: [1] [2] [3].