CVE-2014-2528

MEDIO 6.8CVE-2014-2528 · Published 26/08/2014 · updated 17/06/2026

In breve

CVE-2014-2528 è una vulnerabilità MEDIO (CVSS 6.8) che riguarda kdirstat (kdirstat project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.9%, superiore al 86.9% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
kdirstat kdirstat_project	`= 2.7.3`	No fix yet

Description

kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.

References

lists.opensuse.org/opensuse-updates/2014-08/msg00015.html · Vendor Advisory
openwall.com/lists/oss-security/2014/03/17/2
openwall.com/lists/oss-security/2014/03/18/2 · Patch
bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa · Exploit
bugs.debian.org/cgi-bin/bugreport.cgi

Altre vulnerabilità di kdirstat

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free