CVE-2019-14744

HIGH 7.8CVE-2019-14744 · Published 07/08/2019 · updated 17/06/2026

In short

CVE-2019-14744 is a HIGH (CVSS 7.8) vulnerability affecting kconfig (kde), backports sle (opensuse).
Chance of exploitation in the next 30 days (EPSS): 4.1%, higher than 90.7% of all vulnerabilities.
Fix: update to 5.61.0 or later.

Package	Affected versions	Patched versions
kconfig kde	`< 5.61.0`	`5.61.0`
backports sle opensuse	`= 15.0`	No fix yet

Description

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

References

lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.html · Mailing List
packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.html · Patch
access.redhat.com/errata/RHSA-2019:2606 · Third Party Advisory
gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt · Exploit
lists.debian.org/debian-lts-announce/2019/08/msg00023.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free