CVE-2019-14744

In KDE Frameworks KConfig before 5.61.0, malicious desktop files and configuration files lead to code execution with minimal user interaction. This relates to libKF5ConfigCore.so, and the mishandling of .desktop and .directory files, as demonstrated by a shell command on an Icon line in a .desktop file.

• CWE-78

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.htmlMailing List, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.htmlMailing List, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.htmlMailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.htmlPatch, Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2606Third Party Advisory
• https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txtExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/
• https://seclists.org/bugtraq/2019/Aug/12Mailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Aug/9Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201908-07Third Party Advisory
• https://usn.ubuntu.com/4100-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4494Third Party Advisory
• https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/Press/Media Coverage, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00013.htmlMailing List, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00016.htmlMailing List, Patch, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00034.htmlMailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153981/Slackware-Security-Advisory-kdelibs-Updates.htmlPatch, Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:2606Third Party Advisory
• https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txtExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/08/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IRIKH7ZWXELIQT6WSLV7EG3VTFWKZPD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNHO6FZRYBQ2R3UCFDGS66F6DNNTKCMM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UYKLUSSEK3YJOVQDL6K2LKGS3354UH6L/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTFBQRJAU7ITD3TOMPZAUQMYYCAZ6DTX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDXQ6CUB5E7Y3MJWCUY4VR42QAE6SCJ/
• https://seclists.org/bugtraq/2019/Aug/12Mailing List, Third Party Advisory
• https://seclists.org/bugtraq/2019/Aug/9Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201908-07Third Party Advisory
• https://usn.ubuntu.com/4100-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4494Third Party Advisory
• https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/Press/Media Coverage, Third Party Advisory

Published

Aug 7, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14732AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2…8.8
• CVE-2019-14733AdPlug 2.3.1 has multiple heap-based buffer overflows in Cra…8.8
• CVE-2019-14734AdPlug 2.3.1 has multiple heap-based buffer overflows in Cmt…8.8
• CVE-2019-14737Ubisoft Uplay 92.0.0.6280 has Insecure Permissions.7.8
• CVE-2019-1474An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-14743In Valve Steam Client for Windows through 2019-08-07, HKLM\S…
• CVE-2019-14745In radare2 before 3.7.0, a command injection vulnerability e…7.8
• CVE-2019-14746A issue was discovered in KuaiFanCMS 5.0. It allows eval inj…
• CVE-2019-14747DWSurvey through 2019-07-22 has stored XSS via the design/my…
• CVE-2019-14748An issue was discovered in osTicket before 1.10.7 and 1.12.x…5.4
• CVE-2019-14749An issue was discovered in osTicket before 1.10.7 and 1.12.x…8.8
• CVE-2019-1475Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…