High severity7.8NVD Advisory· Published Aug 7, 2019· Updated Jun 17, 2026

CVE-2019-14744

Description

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

KDE/KConfig2 versions
cpe:2.3:a:kde:kconfig:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:kde:kconfig:*:*:*:*:*:*:*:*range: <5.61.0
- (no CPE)range: <5.61.0
OpenSUSE/Backports Sle
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
Canonical/Ubuntu Linux3 versions
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
KDE Frameworks/KConfigdescription
osv-coords21 versions
pkg:rpm/opensuse/kconfig&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/kconfig&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/kdelibs4&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/kdelibs4&distro=openSUSE%20Leap%2015.1 pkg:rpm/opensuse/kdelibs4-apidocs&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/kdelibs4-apidocs&distro=openSUSE%20Leap%2015.1 pkg:rpm/suse/kconfig&distro=SUSE%20Package%20Hub%2012%20SP1 pkg:rpm/suse/kconfig&distro=SUSE%20Package%20Hub%2012%20SP2 pkg:rpm/suse/kconfig&distro=SUSE%20Package%20Hub%2012%20SP3 pkg:rpm/suse/kconfig&distro=SUSE%20Package%20Hub%2015 pkg:rpm/suse/kconfig&distro=SUSE%20Package%20Hub%2015%20SP1 pkg:rpm/suse/kdelibs4&distro=SUSE%20Package%20Hub%2012%20SP1 pkg:rpm/suse/kdelibs4&distro=SUSE%20Package%20Hub%2012%20SP2 pkg:rpm/suse/kdelibs4&distro=SUSE%20Package%20Hub%2012%20SP3 pkg:rpm/suse/kdelibs4&distro=SUSE%20Package%20Hub%2015 pkg:rpm/suse/kdelibs4&distro=SUSE%20Package%20Hub%2015%20SP1 pkg:rpm/suse/kdelibs4-apidocs&distro=SUSE%20Package%20Hub%2012%20SP1 pkg:rpm/suse/kdelibs4-apidocs&distro=SUSE%20Package%20Hub%2012%20SP2 pkg:rpm/suse/kdelibs4-apidocs&distro=SUSE%20Package%20Hub%2012%20SP3 pkg:rpm/suse/kdelibs4-apidocs&distro=SUSE%20Package%20Hub%2015 pkg:rpm/suse/kdelibs4-apidocs&distro=SUSE%20Package%20Hub%2015%20SP1
< 5.55.0-bp151.3.5.1+ 20 more
- (no CPE)range: < 5.55.0-bp151.3.5.1
- (no CPE)range: < 5.55.0-bp151.3.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 5.55.0-bp151.3.5.1
- (no CPE)range: < 5.55.0-bp151.3.5.1
- (no CPE)range: < 5.55.0-bp151.3.5.1
- (no CPE)range: < 5.55.0-bp151.3.5.1
- (no CPE)range: < 5.55.0-bp151.3.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1
- (no CPE)range: < 4.14.38-bp151.9.5.1

Patches

Vulnerability mechanics

References

lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.htmlnvdMailing ListPatchThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.htmlnvdMailing ListPatchThird Party Advisory
packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.htmlnvdPatchThird Party AdvisoryVDB Entry
gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txtnvdExploitThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.htmlnvdMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2019:2606nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2019/08/msg00023.htmlnvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Aug/12nvdMailing ListThird Party Advisory
seclists.org/bugtraq/2019/Aug/9nvdMailing ListThird Party Advisory
security.gentoo.org/glsa/201908-07nvdThird Party Advisory
usn.ubuntu.com/4100-1/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4494nvdThird Party Advisory
www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/nvdPress/Media CoverageThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/nvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000