| Name | CVE-2017-8422 |
| Description | KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-952-1, DSA-3849-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| kauth (PTS) | stretch | 5.28.0-2+deb9u1 | fixed |
| buster | 5.54.0-2 | fixed |
| bullseye | 5.78.0-2 | fixed |
| bookworm | 5.103.0-1 | fixed |
| sid, trixie | 5.115.0-2 | fixed |
| kde4libs (PTS) | jessie, jessie (lts) | 4:4.14.2-5+deb8u3 | fixed |
| stretch (lts), stretch | 4:4.14.26-2+deb9u1 | fixed |
| buster | 4:4.14.38-3 | fixed |
The information below is based on the following data on fixed versions.
Notes
https://www.openwall.com/lists/oss-security/2017/05/10/3
patch for kauth: https://github.com/KDE/kauth/commit/df875f725293af53399f5146362eb158b4f9216a
patch for kde4libs: https://github.com/KDE/kdelibs/commit/264e97625abe2e0334f97de17f6ffb52582888ab
https://www.kde.org/info/security/advisory-20170510-1.txt