Vulnerability in Kdirstat Project
CVE-2014-2528
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.
EPSS: 0.029 (85.4th percentile) — read the EPSS interpretation.
Affected products
- Kdirstat_project Kdirstat — versions 2.7.3
- Opensuse — versions 13.1
- N/a — versions n/a
References
- cve@mitre.org (x_refsource_CONFIRM, Exploit, Patch)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE, Vendor Advisory)
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Patch)
- cve@mitre.org (x_refsource_CONFIRM)