security fix for CVE-2017-8422.
https://www.kde.org/info/security/advisory-20170510-1.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for kdelibs4 fixes the following issues :

  - CVE-2017-8422: This update fixes problem in the DBUS     authentication of the kauth framework that could be used     to escalate privileges depending on bugs or     misimplemented dbus services. (boo#1036244)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A privilege escalation flaw was found in the way kdelibs     handled D-Bus messages. A local user could potentially     use this flaw to gain root privileges by spoofing a     callerID and leveraging a privileged helper application.
    (CVE-2017-8422)

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2017-6410

Itzik Kotler, Yonatan Fridburg and Amit Klein of Safebreach Labs reported that URLs are not sanitized before passing them to FindProxyForURL, potentially allowing a remote attacker to obtain sensitive information via a crafted PAC file.

CVE-2017-8422

Sebastian Krahmer from SUSE discovered that the KAuth framework contains a logic flaw in which the service invoking dbus is not properly checked. This flaw allows spoofing the identity of the caller and gaining root privileges from an unprivileged account.

CVE-2013-2074

It was discovered that KIO would show web authentication credentials in some error cases.

For Debian 7 'Wheezy', these problems have been fixed in version 4:4.8.4-4+deb7u3.

We recommend that you upgrade your kde4libs packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in kde4libs, the core libraries for all KDE 4 applications. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-6410     Itzik Kotler, Yonatan Fridburg and Amit Klein of     Safebreach Labs reported that URLs are not sanitized     before passing them to FindProxyForURL, potentially     allowing a remote attacker to obtain sensitive     information via a crafted PAC file.

  - CVE-2017-8422     Sebastian Krahmer from SUSE discovered that the KAuth     framework contains a logic flaw in which the service     invoking dbus is not properly checked. This flaw allows     spoofing the identity of the caller and gaining root     privileges from an unprivileged account.

New kdelibs packages are available for Slackware 13.37, 14.0, 14.1, 14.2, and -current to fix a security issue.

An update for kdelibs is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The K Desktop Environment (KDE) is a graphical desktop environment for the X Window System. The kdelibs packages include core libraries for the K Desktop Environment.

Security Fix(es) :

* A privilege escalation flaw was found in the way kdelibs handled D-Bus messages. A local user could potentially use this flaw to gain root privileges by spoofing a callerID and leveraging a privileged helper application. (CVE-2017-8422)

Red Hat would like to thank Sebastian Krahmer (SUSE) for reporting this issue.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101735	Fedora 26 : 6:kdelibs (2017-dd51077c87)	Nessus	Fedora Local Security Checks	2017/7/17	2025/12/10	high
100290	SUSE SLED12 / SLES12 Security Update : kdelibs4 (SUSE-SU-2017:1335-1)	Nessus	SuSE Local Security Checks	2017/5/19	2025/12/18	high
100349	Scientific Linux Security Update : kdelibs on SL7.x x86_64 (20170522)	Nessus	Scientific Linux Local Security Checks	2017/5/23	2025/12/18	high
100431	Debian DLA-952-1 : kde4libs security update	Nessus	Debian Local Security Checks	2017/5/26	2025/12/17	high
100163	Debian DSA-3849-1 : kde4libs - security update	Nessus	Debian Local Security Checks	2017/5/15	2025/12/18	high
100191	Fedora 24 : kf5-kauth (2017-6bdbf57f29)	Nessus	Fedora Local Security Checks	2017/5/16	2025/12/18	high
100224	Slackware 13.37 / 14.0 / 14.1 / 14.2 / current : kdelibs (SSA:2017-136-02)	Nessus	Slackware Local Security Checks	2017/5/17	2025/12/18	high
100328	CentOS 7 : kdelibs (CESA-2017:1264)	Nessus	CentOS Local Security Checks	2017/5/23	2021/1/4	high
101567	Fedora 26 : kf5-kauth (2017-0898c704a1)	Nessus	Fedora Local Security Checks	2017/7/17	2025/12/10	high

检测

插件搜索

high

high

high

high

high

high

high

high

high