PT-2014-1999 · Kde · Sddm

Vasyl Kaigorodov · Publicado 2014-10-08 · Atualizado 2024-06-15 · CVE-2014-7272

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Desktop Display Manager (SDDM) versions prior to 0.10.0

Description The issue allows local users to gain root privileges due to code running as root performing write operations within a user's home directory. This can be exploited if the user has created links in advance, and in some cases, requires winning a race condition in the ~/.Xauthority chown case. The vulnerability is related to insufficient access control.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and files within the user's home directory to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2018-00590

CVE-2014-7272

MGASA-2014-0504

OPENSUSE-SU-2024:10135-1

Produtos afetados

Sddm

Referências · 19

• https://github.com/sddm/sddm/releases/tag/v0.10.0 · Nota
• https://github.com/sddm/sddm/pull/280 · Correção
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141550.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7272 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141494.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-0856 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1149610 · Nota
• https://osv.dev/vulnerability/CVE-2014-7272 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10135-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-7272 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0504 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00590 · Nota de Segurança
• https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141494.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-7272 · Nota
• https://suse.com/security/cve/CVE-2014-7271 · Nota