CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

KDE : Security Vulnerabilities (Gain Privilege)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-0436 362 +Priv 2010-04-15 2010-08-21
6.9
None Local Medium Not required Complete Complete Complete
Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.
2 CVE-2006-2916 +Priv 2006-06-15 2010-04-02
6.0
Admin Local High Single system Complete Complete Complete
artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing setuid to fail, which prevents artsd from dropping privileges.
3 CVE-2005-0205 +Priv 2005-05-02 2010-08-21
4.6
User Local Low Not required Partial Partial Partial
KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain wrappers, does not properly close a privileged file descriptor for a domain socket, which allows local users to read and write to /etc/hosts and /etc/resolv.conf and gain control over DNS name resolution by opening a number of file descriptors before executing kppp.
4 CVE-2003-0690 +Priv 2003-10-06 2008-09-10
10.0
Admin Remote Low Not required Complete Complete Complete
KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module.
5 CVE-2001-0782 +Priv 2001-10-18 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
KDE ktvision 0.1.1-271 and earlier allows local attackers to gain root privileges via a symlink attack on a user configuration file.
6 CVE-2001-0610 +Priv 2001-08-02 2008-09-10
4.6
None Local Low Not required Partial Partial Partial
kfm as included with KDE 1.x can allow a local attacker to gain additional privileges via a symlink attack in the kfm cache directory in /tmp.
7 CVE-2000-0460 Overflow +Priv 2000-05-27 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
Buffer overflow in KDE kdesud on Linux allows local uses to gain privileges via a long DISPLAY environmental variable.
8 CVE-2000-0393 +Priv 2000-05-16 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
The KDE kscd program does not drop privileges when executing a program specified in a user's SHELL environmental variable, which allows the user to gain privileges by specifying an alternate program to execute.
9 CVE-2000-0373 +Priv 1999-06-01 2008-09-10
7.2
Admin Local Low Not required Complete Complete Complete
Vulnerabilities in the KDE kvt terminal program allow local users to gain root privileges.
10 CVE-1999-1096 Overflow +Priv 1998-05-16 2008-09-05
7.2
Admin Local Low Not required Complete Complete Complete
Buffer overflow in kscreensaver in KDE klock allows local users to gain root privileges via a long HOME environmental variable.
11 CVE-1999-0735 +Priv 2000-01-04 2008-09-09
4.6
None Local Low Not required Partial Partial Partial
KDE K-Mail allows local users to gain privileges via a symlink attack in temporary user directories.
Total number of vulnerabilities : 11   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.