CVE-2019-7443
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as...
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
CVE-2019-7443- Updated
- 2026-11-02
EUVDEUVD-2019-16985 No score
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
EUVD-2019-16985- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wmpm-pm59-7mfw
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as...
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
GHSA-wmpm-pm59-7mfw- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-7443
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
DEBIAN-CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2019-7443
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
UBUNTU-CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0242-1 No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
- Record
openSUSE-SU-2019:0242-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0247-1 No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:0247-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1051-1 No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:1051-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1277-1 No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:1277-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10887-1 No score
kauth-devel-5.86.0-1.2 on GA media
These are all security issues fixed in the kauth-devel-5.86.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10887-1- Updated
- 2026-11-02
OSVUSN-6035-1 No score
kauth vulnerability
It was discovered that KAuth incorrectly handled some configuration parameters with specially crafted arbitrary types. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.
- Record
USN-6035-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kauthDebian:12 |
before 5.54.0-2 | 5.54.0-2 |
kauthDebian:13 |
before 5.54.0-2 | 5.54.0-2 |
kauthDebian:14 |
before 5.54.0-2 | 5.54.0-2 |
kauthUbuntu:Pro:16.04:LTS |
before 5.18.0-0ubuntu2+esm1, plus listed versions 5.15.0-0ubuntu15.15.0-0ubuntu25.18.0-0ubuntu15.18.0-0ubuntu2 |
5.18.0-0ubuntu2+esm1 |
kauthUbuntu:Pro:18.04:LTS |
before 5.44.0-0ubuntu1+esm1, plus listed versions 5.38.0-0ubuntu15.40.0-0ubuntu15.41.0-0ubuntu15.42.0-0ubuntu15.43.0-0ubuntu15.44.0-0ubuntu1 |
5.44.0-0ubuntu1+esm1 |
extra-cmake-modulesSUSE:Package Hub 12 SP1 |
before 5.32.0-7.2 | 5.32.0-7.2 |
kauthSUSE:Package Hub 12 SP1 |
before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 12 SP1 |
before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 12 SP1 |
before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesSUSE:Package Hub 12 SP2 |
before 5.32.0-7.2 | 5.32.0-7.2 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kauthSUSE:Package Hub 12 SP2 |
before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 12 SP2 |
before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 12 SP2 |
before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesSUSE:Package Hub 12 SP3 |
before 5.32.0-7.2 | 5.32.0-7.2 |
kauthSUSE:Package Hub 12 SP3 |
before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 12 SP3 |
before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 12 SP3 |
before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesSUSE:Package Hub 15 |
before 5.32.0-7.2 | 5.32.0-7.2 |
kauthSUSE:Package Hub 15 |
before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 15 |
before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 15 |
before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesopenSUSE:Leap 15.0 |
before 5.32.0-7.2 | 5.32.0-7.2 |
kauthopenSUSE:Leap 15.0 |
before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsopenSUSE:Leap 15.0 |
before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1openSUSE:Leap 15.0 |
before 0.112.0-5.2 | 0.112.0-5.2 |
kauthSUSE:Package Hub 15 |
before 5.45.0-bp150.3.6.1 | 5.45.0-bp150.3.6.1 |
kauthSUSE:Package Hub 15 |
before 5.32.0-bp150.3.10.1 | 5.32.0-bp150.3.10.1 |
kcoreaddonsSUSE:Package Hub 15 |
before 5.32.0-bp150.3.3.1 | 5.32.0-bp150.3.3.1 |
polkit-qt5-1SUSE:Package Hub 15 |
before 0.112.0-bp150.3.3.1 | 0.112.0-bp150.3.3.1 |
kauthSUSE:Package Hub 15 |
before 5.45.0-bp150.8.2 | 5.45.0-bp150.8.2 |
polkit-qt5-1SUSE:Package Hub 15 |
before 0.112.0-bp150.3.6.1 | 0.112.0-bp150.3.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-7443 is a high vulnerability (CVSS 8.1) in Kde Kauth, published February 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in kauth 5.54.0-2.
References
lists.opensuse.org/opensuse-security-announce/2019-02/msg00060.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAWLQKTUQJOAPXOFWJQAQCA4LVM2P45F
cgit.kde.org/kauth.git/commit?id=fc70fb0161c1b9144d26389434d34dd135cd3f4a
bugzilla.suse.com/show_bug.cgi?id=1124863
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-7443
github.com/advisories/GHSA-wmpm-pm59-7mfw
security-tracker.debian.org/tracker/CVE-2019-7443
ubuntu.com/security/CVE-2019-7443
mail.kde.org/pipermail/kde-announce/2019-February/000011.html
cve.org/CVERecord?id=CVE-2019-7443
suse.com/security/cve/CVE-2019-7443