7.8

CVE-2018-10380

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kde ≫ Plasma Version < 5.12.6
Debian ≫ Debian Linux Version9.0
Opensuse ≫ Leap Version15.0
Opensuse ≫ Leap Version42.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.43% 0.345
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://bugzilla.suse.com/show_bug.cgi?id=1090863
Patch
Third Party Advisory
Issue Tracking
https://commits.kde.org/kwallet-pam/01d4143fda5bddb6dca37b23304dc239a5fb38b5
Patch
Vendor Advisory
https://commits.kde.org/kwallet-pam/2134dec85ce19d6378d03cddfae9e5e464cb24c0
Patch
Vendor Advisory
https://commits.kde.org/kwallet-pam/802f305d81f8771c4f4a8bd7fd0e368ffc6f9b3b
Patch
Vendor Advisory
https://commits.kde.org/kwallet-pam/99abc7fde21f40cc6da5feb6ee766cc46fcca1f8
Patch
Vendor Advisory
https://www.debian.org/security/2018/dsa-4200
Third Party Advisory
https://www.kde.org/info/security/advisory-20180503-1.txt
Patch
Vendor Advisory