REDHAT-BUG-1740138: High severity kde kconfig vulnerability
In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.
External References:
https://kde.org/info/security/advisory-20190807-1.txt
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1740138?
The severity of REDHAT-BUG-1740138 is classified as critical due to the potential for code execution with minimal user interaction.
How do I fix REDHAT-BUG-1740138?
To fix REDHAT-BUG-1740138, upgrade KDE KConfig to a version higher than 5.61.0.
Who is affected by REDHAT-BUG-1740138?
Users running KDE KConfig versions prior to 5.61.0 are affected by REDHAT-BUG-1740138.
What types of files are involved in the vulnerability REDHAT-BUG-1740138?
REDHAT-BUG-1740138 involves malicious .desktop and .directory files.
Is user interaction required for the exploit in REDHAT-BUG-1740138?
Yes, REDHAT-BUG-1740138 requires minimal user interaction for the exploit to be triggered.