CVE-2024-36041

July 5, 2024, 12:55 p.m.

Tags

cve@mitre.org
2024-07-05
CVE-2024-36041

Product(s) Impacted

KDE Plasma Workspace

  • 5.27.11.1
  • before 5.27.11.1
  • 6.x
  • before 6.0.5.1

Description

KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.

Weaknesses

Date

Published: July 5, 2024, 2:15 a.m.

Last Modified: July 5, 2024, 12:55 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

References

https://github.com/KDE/plasma-workspace/tags
cve@mitre.org
https://invent.kde.org/plasma/plasma-workspace/
cve@mitre.org
https://kde.org/info/security/advisory-20240531-1.txt
cve@mitre.org
https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html
cve@mitre.org