PublicDateAtUSN: 2017-05-10
Candidate: CVE-2017-8422
PublicDate: 2017-05-17 14:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8422
 http://www.openwall.com/lists/oss-security/2017/05/10/3
 https://www.kde.org/info/security/advisory-20170510-1.txt
 https://ubuntu.com/security/notices/USN-3286-1
Description:
 KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain
 root privileges by spoofing a callerID and leveraging a privileged helper
 app.
Ubuntu-Description:
Notes:
Bugs:
 https://bugs.launchpad.net/ubuntu/+source/kauth/+bug/1689759
Priority: high
Discovered-by: Sebastian Krahmer
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H [7.8 HIGH]

Patches_kauth:
 upstream: https://cgit.kde.org/kauth.git/commit/?id=df875f725293af53399f5146362eb158b4f9216a
upstream_kauth: released (5.34)
precise/esm_kauth: DNE
trusty_kauth: DNE
trusty/esm_kauth: DNE
vivid/stable-phone-overlay_kauth: DNE
vivid/ubuntu-core_kauth: DNE
xenial_kauth: released (5.18.0-0ubuntu2)
yakkety_kauth: released (5.26.0-0ubuntu2.1)
zesty_kauth: released (5.31.0-0ubuntu1.1)
devel_kauth: released (5.33.0-0ubuntu2)

Patches_kde4libs:
 upstream: https://commits.kde.org/kdelibs/264e97625abe2e0334f97de17f6ffb52582888ab
upstream_kde4libs: released (4.14.32)
precise/esm_kde4libs: DNE
trusty_kde4libs: released (4:4.13.3-0ubuntu0.5)
trusty/esm_kde4libs: released (4:4.13.3-0ubuntu0.5)
vivid/stable-phone-overlay_kde4libs: DNE
vivid/ubuntu-core_kde4libs: DNE
xenial_kde4libs: released (4:4.14.16-0ubuntu3.2)
yakkety_kde4libs: released (4:4.14.22-0ubuntu2.2)
zesty_kde4libs: released (4:4.14.30-0ubuntu1.1)
devel_kde4libs: released (4:4.14.30-0ubuntu2)