CVE-2018-10380

Upstream information

CVE-2018-10380 at MITRE

Description

kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack.

---

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v2 Scores

	National Vulnerability Database
Base Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
Access Vector	Local
Access Complexity	Low
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	Complete
Availability Impact	Complete

CVSS v3 Scores

	National Vulnerability Database
Base Score	7.8
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Local
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3

SUSE Bugzilla entry: 1090863 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2018:1149-1, published Sat, 5 May 2018 00:07:36 +0200 (CEST)

List of released packages

Product(s)	Fixed package version(s)	References
openSUSE Tumbleweed	pam_kwallet >= 5.22.5-2.2 pam_kwallet-32bit >= 5.22.5-2.2 pam_kwallet-common >= 5.22.5-2.2	Patchnames: openSUSE Tumbleweed GA pam_kwallet-32bit-5.22.5-2.2

---

SUSE Timeline for this CVE

CVE page created: Wed Apr 25 12:30:27 2018
CVE page last modified: Wed Oct 26 21:18:00 2022