PT-2019-18616 · Kde+3 · Kde Kauth+3

Published 2019-02-13 · Updated 2023-04-20 · CVE-2019-7443

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions KDE KAuth versions prior to 5.55

Description The issue allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. This can cause crashes and trigger the decoding of arbitrary images with dynamically loaded plugins, increasing the severity of any possible exploitation of a plugin vulnerability.

Recommendations For versions prior to 5.55, update to version 5.55 or later to resolve the issue. As a temporary workaround, consider restricting the use of DBusHelperProxy.cpp to minimize the risk of exploitation. Avoid using arbitrary types when passing parameters to helpers running as root over DBus until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-1228

CVE-2019-7443

OPENSUSE-SU-2019:0242-1

OPENSUSE-SU-2019:0247-1

OPENSUSE-SU-2019:1051-1

OPENSUSE-SU-2019:1277-1

OPENSUSE-SU-2019_0242-1

OPENSUSE-SU-2024:10887-1

USN-6035-1

Affected Products

Alt Linux

Kde Kauth

Suse

Ubuntu

References · 32

• https://osv.dev/vulnerability/CVE-2019-7443 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAWLQKTUQJOAPXOFWJQAQCA4LVM2P45F · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-7443 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7443 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7443 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1228 · Vendor Advisory
• https://cgit.kde.org/kauth.git/commit/?id=fc70fb0161c1b9144d26389434d34dd135cd3f4a · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1051-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7443 · Vendor Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1124863 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXVUJNXB6QKGPT6YJPJSG3U2BIR5XK5Y · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:0242-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:0247-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-7443 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7443 · Security Note