CVE-2014-2528
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which...
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
Exploit likelihood
What each source reports
NVD Score used
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
- Record
CVE-2014-2528- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
- Record
CVE-2014-2528- Updated
- 2026-11-02
EUVDEUVD-2014-2564 No score
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
- Record
EUVD-2014-2564- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fm3p-w9c3-9p34 No score
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which...
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
- Record
GHSA-fm3p-w9c3-9p34- Updated
- 2026-11-02
OSV No score
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
- Record
CVE-2014-2528- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-2528 No score
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
- Record
DEBIAN-CVE-2014-2528- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10000-1 No score
kdirstat-2.4.4-277.11 on GA media
These are all security issues fixed in the kdirstat-2.4.4-277.11 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10000-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2528 is a medium vulnerability (CVSS 6.8) in Kdirstat Project Kdirstat, published August 26, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in k4dirstat 2.7.5-1.
References
bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa
lists.opensuse.org/opensuse-updates/2014-08/msg00015.html
openwall.com/lists/oss-security/2014/03/17/2
bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659
nvd.nist.gov/vuln/detail/CVE-2014-2528
github.com/advisories/GHSA-fm3p-w9c3-9p34
security-tracker.debian.org/tracker/CVE-2014-2528
suse.com/security/cve/CVE-2014-2528