CVE-2014-8651
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1...
CVE-2014-8651 is a high vulnerability (CVSS 7.2) in Kde Kde-workspace, published November 7, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in kdebase4-workspace 4.10.5-1.2.mga3.
- Severity
- 7.2 HighCVSS 2.0, NVD
- Exploit chance
- 0.39%EPSS, 33rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.10.5-1.2.mga3kdebase4-workspace +18 more
Description
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kdebase4-workspaceMageia:3 | before 4.10.5-1.2.mga3 | 4.10.5-1.2.mga3 |
kdebase4-workspaceMageia:4 | before 4.11.14-1.mga4 | 4.11.14-1.mga4 |
kdebase4-workspaceSUSE:Linux Enterprise Software Development Kit 11 SP3 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Software Development Kit 11 SP4 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kdebase4-wallpapersSUSE:Linux Enterprise Desktop 11 SP3 | before 4.3.5-0.11.20.1 | 4.3.5-0.11.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Desktop 11 SP3 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kdebase4-wallpapersSUSE:Linux Enterprise Desktop 11 SP4 | before 4.3.5-0.11.20.1 | 4.3.5-0.11.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Desktop 11 SP4 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kdebase4-wallpapersSUSE:Linux Enterprise Server 11 SP3 | before 4.3.5-0.11.20.1 | 4.3.5-0.11.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Server 11 SP3 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kdebase4-wallpapersSUSE:Linux Enterprise Server 11 SP3-TERADATA | before 4.3.5-0.11.20.1 | 4.3.5-0.11.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Server 11 SP3-TERADATA | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kdebase4-wallpapersSUSE:Linux Enterprise Server for SAP Applications 11 SP3 | before 4.3.5-0.11.20.1 | 4.3.5-0.11.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Server for SAP Applications 11 SP3 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kdebase4-wallpapersSUSE:Linux Enterprise Server 11 SP4 | before 4.3.5-0.11.20.1 | 4.3.5-0.11.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Server 11 SP4 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kdebase4-wallpapersSUSE:Linux Enterprise Server for SAP Applications 11 SP4 | before 4.3.5-0.11.20.1 | 4.3.5-0.11.20.1 |
kdebase4-workspaceSUSE:Linux Enterprise Server for SAP Applications 11 SP4 | before 4.3.5-0.12.20.1 | 4.3.5-0.12.20.1 |
kde-workspaceUbuntu:14.04:LTS | before 4:4.11.11-0ubuntu0.2, plus listed versions 4:4.11.2-0ubuntu14:4.11.2-0ubuntu24:4.11.3-0ubuntu14:4.11.3-0ubuntu24:4.11.4-0ubuntu1 Show 20 moreShow less4:4.11.4-0ubuntu24:4.11.4-0ubuntu34:4.11.5-0ubuntu14:4.11.5-0ubuntu24:4.11.5-0ubuntu34:4.11.5-0ubuntu44:4.11.6-0ubuntu14:4.11.6-0ubuntu24:4.11.6-0ubuntu44:4.11.6-0ubuntu54:4.11.7-0ubuntu14:4.11.8-0ubuntu14:4.11.8-0ubuntu24:4.11.8-0ubuntu34:4.11.8-0ubuntu44:4.11.8-0ubuntu54:4.11.8-0ubuntu64:4.11.9-0ubuntu0.24:4.11.10-0ubuntu0.14:4.11.11-0ubuntu0.1 | 4:4.11.11-0ubuntu0.2 |
What each source reports
NVD Score used
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
- Record
CVE-2014-8651- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
- Record
CVE-2014-8651- Updated
- 2026-11-02
EUVDEUVD-2014-8487No score
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
- Record
EUVD-2014-8487- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qpg7-58m4-m59vNo score
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1...
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
- Record
GHSA-qpg7-58m4-m59v- Updated
- 2026-11-02
OSVMGASA-2014-0445No score
Updated kdebase4-workspace packages fix security vulnerability and various bugs
This update fixes a security vulnerability in the KDE workspace configuration module for setting the date and time (CVE-2014-8651, mga#14487), and fixes some additional issues:
- fix kcm botching unrelated user settings (mga#3310, bko#254430),
- do not popup during initialization 0 B Removable media (mga#11050, bko#318061),
- fix new graphical session numbers (mga#9086).
- Record
MGASA-2014-0445- Updated
- 2026-11-02
OSVMGASA-2014-0480No score
Updated kdebase4-workspace packages fix security vulnerability and various bugs
This update fixes a security vulnerability in the KDE workspace configuration module for setting the date and time (CVE-2014-8651, mga#14578), and fixes some additional issues:
- fix foreground color for GTK2 menus (bko#127861),
- improve contrast for rendering checkbox marks, arrows, etc. (bko#337433),
- fix icons size in kmenuedit (bko#338883).
- Record
MGASA-2014-0480- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10328-1No score
plasma5-desktop-5.8.4-1.1 on GA media
These are all security issues fixed in the plasma5-desktop-5.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10328-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0303-1No score
Security update for kdebase4-workspace
This update for kdebase4-workspace fixes the following issues:
- CVE-2014-8651: Privilege escalation via KDE Clock KCM helper when non-default polkit settings are used (bsc#904625)
The following non-security bugs were fixed:
- bsc#929718: Make kdm recognize an IPv6 localhost address as localhost
- Record
SUSE-SU-2016:0303-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-8651No score
The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.
- Record
UBUNTU-CVE-2014-8651- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/pipermail/package-announce/2014-November/143781.html
openwall.com/lists/oss-security/2014/11/04/9
security.gentoo.org/glsa/201512-12
kde.org/info/security/advisory-20141106-1.txt
ubuntu.com/usn/USN-2402-1
Show 23 moreShow less
securityfocus.com/bid/70904
nvd.nist.gov/vuln/detail/CVE-2014-8651
github.com/advisories/GHSA-qpg7-58m4-m59v
advisories.mageia.org/MGASA-2014-0445.html
bugs.mageia.org/show_bug.cgi?id=14487
bugs.kde.org/show_bug.cgi?id=127861
suse.com/support/update/announcement/2016/suse-su-20160303-1
bugzilla.suse.com/904625
ubuntu.com/security/CVE-2014-8651
git.reviewboard.kde.org/r/120977
cve.org/CVERecord?id=CVE-2014-8651