CVE-2014-2528

Published: Aug 26, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.

Affected (2)

Products: Kdirstat Project: Kdirstat · Opensuse: Opensuse

Kdirstat Project

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Kdirstat Project Kdirstat	Version 2.7.3
Opensuse Opensuse	Version 13.1

References (10)

http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html

Source: cve@mitre.org

Vendor Advisory

http://www.openwall.com/lists/oss-security/2014/03/17/2

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2014/03/18/2

Source: cve@mitre.org

Patch

https://bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa#chg-src/kcleanup.cpp

Source: cve@mitre.org

ExploitPatch

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2014-08/msg00015.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.openwall.com/lists/oss-security/2014/03/17/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2014/03/18/2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://bitbucket.org/jeromerobert/k4dirstat/commits/1ad2e96d73fa06cd9be0f3749b337c03575016aa#chg-src/kcleanup.cpp

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741659

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.