CVE-2014-8651

The KDE Clock KCM policykit helper in kde-workspace before 4.11.14 and plasma-desktop before 5.1.1 allows local users to gain privileges via a crafted ntpUtility (ntp utility name) argument.

Published Bycve@mitre.org

Published DateDec 06, 2014, 21:59

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

7.2

Vector String

AV:L/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-November/143781.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144034.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/144093.html
http://www.openwall.com/lists/oss-security/2014/11/04/9
http://www.openwall.com/lists/oss-security/2014/11/07/3
http://www.securityfocus.com/bid/70904
http://www.ubuntu.com/usn/USN-2402-1
https://security.gentoo.org/glsa/201512-12
https://www.kde.org/info/security/advisory-20141106-1.txt

Weakness Type (CWE):CWE-264

CVSS Metrics

Base Score

7.2

Vector String

AV:L/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE