CVE-2019-7443
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as...
CVE-2019-7443 is a high vulnerability (CVSS 8.1) in Kde Kauth, published February 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in kauth 5.54.0-2.
- Severity
- 8.1 HighCVSS 3.0, NVD
- Exploit chance
- 2.35%EPSS, 83rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.54.0-2kauth +30 more
Description
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kauthDebian:12 | before 5.54.0-2 | 5.54.0-2 |
kauthDebian:13 | before 5.54.0-2 | 5.54.0-2 |
kauthDebian:14 | before 5.54.0-2 | 5.54.0-2 |
kauthUbuntu:Pro:16.04:LTS | before 5.18.0-0ubuntu2+esm1, plus listed versions 5.15.0-0ubuntu15.15.0-0ubuntu25.18.0-0ubuntu15.18.0-0ubuntu2 | 5.18.0-0ubuntu2+esm1 |
kauthUbuntu:Pro:18.04:LTS | before 5.44.0-0ubuntu1+esm1, plus listed versions 5.38.0-0ubuntu15.40.0-0ubuntu15.41.0-0ubuntu15.42.0-0ubuntu15.43.0-0ubuntu15.44.0-0ubuntu1 | 5.44.0-0ubuntu1+esm1 |
extra-cmake-modulesSUSE:Package Hub 12 SP1 | before 5.32.0-7.2 | 5.32.0-7.2 |
kauthSUSE:Package Hub 12 SP1 | before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 12 SP1 | before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 12 SP1 | before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesSUSE:Package Hub 12 SP2 | before 5.32.0-7.2 | 5.32.0-7.2 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kauthSUSE:Package Hub 12 SP2 | before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 12 SP2 | before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 12 SP2 | before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesSUSE:Package Hub 12 SP3 | before 5.32.0-7.2 | 5.32.0-7.2 |
kauthSUSE:Package Hub 12 SP3 | before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 12 SP3 | before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 12 SP3 | before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesSUSE:Package Hub 15 | before 5.32.0-7.2 | 5.32.0-7.2 |
kauthSUSE:Package Hub 15 | before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsSUSE:Package Hub 15 | before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1SUSE:Package Hub 15 | before 0.112.0-5.2 | 0.112.0-5.2 |
extra-cmake-modulesopenSUSE:Leap 15.0 | before 5.32.0-7.2 | 5.32.0-7.2 |
kauthopenSUSE:Leap 15.0 | before 5.45.0-bp150.5.2 | 5.45.0-bp150.5.2 |
kcoreaddonsopenSUSE:Leap 15.0 | before 5.45.0-bp150.3.6.2 | 5.45.0-bp150.3.6.2 |
polkit-qt5-1openSUSE:Leap 15.0 | before 0.112.0-5.2 | 0.112.0-5.2 |
kauthSUSE:Package Hub 15 | before 5.45.0-bp150.3.6.1 | 5.45.0-bp150.3.6.1 |
kauthSUSE:Package Hub 15 | before 5.32.0-bp150.3.10.1 | 5.32.0-bp150.3.10.1 |
kcoreaddonsSUSE:Package Hub 15 | before 5.32.0-bp150.3.3.1 | 5.32.0-bp150.3.3.1 |
polkit-qt5-1SUSE:Package Hub 15 | before 0.112.0-bp150.3.3.1 | 0.112.0-bp150.3.3.1 |
kauthSUSE:Package Hub 15 | before 5.45.0-bp150.8.2 | 5.45.0-bp150.8.2 |
polkit-qt5-1SUSE:Package Hub 15 | before 0.112.0-bp150.3.6.1 | 0.112.0-bp150.3.6.1 |
What each source reports
NVD Score used
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
CVE-2019-7443- Updated
- 2026-11-02
EUVDEUVD-2019-16985No score
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
EUVD-2019-16985- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wmpm-pm59-7mfw
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as...
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
GHSA-wmpm-pm59-7mfw- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-7443
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
DEBIAN-CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2019-7443
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
- Record
UBUNTU-CVE-2019-7443- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0242-1No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
- Record
openSUSE-SU-2019:0242-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0247-1No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:0247-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1051-1No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:1051-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1277-1No score
Security update for kauth
This update for kauth fixes the following issues:
Security issue fixed:
- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants (bsc#1124863).
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:1277-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10887-1No score
kauth-devel-5.86.0-1.2 on GA media
These are all security issues fixed in the kauth-devel-5.86.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10887-1- Updated
- 2026-11-02
OSVUSN-6035-1No score
kauth vulnerability
It was discovered that KAuth incorrectly handled some configuration parameters with specially crafted arbitrary types. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.
- Record
USN-6035-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-security-announce/2019-02/msg00060.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAWLQKTUQJOAPXOFWJQAQCA4LVM2P45F
cgit.kde.org/kauth.git/commit?id=fc70fb0161c1b9144d26389434d34dd135cd3f4a
bugzilla.suse.com/show_bug.cgi?id=1124863
Show 16 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-7443
github.com/advisories/GHSA-wmpm-pm59-7mfw
security-tracker.debian.org/tracker/CVE-2019-7443
ubuntu.com/security/CVE-2019-7443
mail.kde.org/pipermail/kde-announce/2019-February/000011.html
cve.org/CVERecord?id=CVE-2019-7443
suse.com/security/cve/CVE-2019-7443