CVE-2018-6791

An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.
Configurations

Configuration 1 (hide)

cpe:2.3:a:kde:plasma-workspace:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-02-07 02:29

Updated : 2024-02-28 16:25


NVD link : CVE-2018-6791

Mitre link : CVE-2018-6791

CVE.ORG link : CVE-2018-6791


JSON object : View

Products Affected

debian

  • debian_linux

kde

  • plasma-workspace
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')