Vulnerability in Kdirstat Project
CVE-2014-2527
kcleanup.cpp in KDirStat 2.7.0 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a " (double quote) character in the directory name, a different vulnerability than CVE-2014-2528.
EPSS: 0.030 (86.0th percentile) — read the EPSS interpretation.
Affected products
- Kdirstat_project Kdirstat — versions 2.7.0
- Opensuse — versions 13.1
- N/a — versions n/a
References
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Patch)
- cve@mitre.org (x_refsource_CONFIRM)