PT-2014-1999 · Kde · Sddm

Vasyl Kaigorodov · Published 2014-10-08 · Updated 2024-06-15 · CVE-2014-7272

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple Desktop Display Manager (SDDM) versions prior to 0.10.0

Description The issue allows local users to gain root privileges due to code running as root performing write operations within a user's home directory. This can be exploited if the user has created links in advance, and in some cases, requires winning a race condition in the ~/.Xauthority chown case. The vulnerability is related to insufficient access control.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories and files within the user's home directory to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00590

CVE-2014-7272

MGASA-2014-0504

OPENSUSE-SU-2024:10135-1

Affected Products

Sddm

References · 19

• https://github.com/sddm/sddm/pull/280 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141550.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7272 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141494.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7272 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10135-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-7272 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0504 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00590 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-October/141494.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7272 · Security Note
• https://advisories.mageia.org/MGASA-2014-0504.html · Security Note
• https://github.com/sddm/sddm/releases/tag/v0.10.0 · Note
• https://suse.com/security/cve/CVE-2015-0856 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1149610 · Note