<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for kauth</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2019:1277-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2019-04-26T05:55:02Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2019-04-26T05:55:02Z</InitialReleaseDate>
    <CurrentReleaseDate>2019-04-26T05:55:02Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for kauth</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for kauth fixes the following issues:

Security issue fixed:

- CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing
  the support of passing gui variants (bsc#1124863).
 
This update was imported from the openSUSE:Leap:15.0:Update update project.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">openSUSE-2019-1277</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DYXRURFCJ4V45YTWBIHAHA4MX62HBZCX/#DYXRURFCJ4V45YTWBIHAHA4MX62HBZCX</URL>
      <Description>E-Mail link for openSUSE-SU-2019:1277-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1124863</URL>
      <Description>SUSE Bug 1124863</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2019-7443/</URL>
      <Description>SUSE CVE CVE-2019-7443 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Package Hub 15">
      <Branch Type="Product Name" Name="SUSE Package Hub 15">
        <FullProductName ProductID="SUSE Package Hub 15">SUSE Package Hub 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="kauth-devel-5.45.0-bp150.8.2">
      <FullProductName ProductID="kauth-devel-5.45.0-bp150.8.2">kauth-devel-5.45.0-bp150.8.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="kauth-devel-64bit-5.45.0-bp150.8.2">
      <FullProductName ProductID="kauth-devel-64bit-5.45.0-bp150.8.2">kauth-devel-64bit-5.45.0-bp150.8.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libKF5Auth5-5.45.0-bp150.8.2">
      <FullProductName ProductID="libKF5Auth5-5.45.0-bp150.8.2">libKF5Auth5-5.45.0-bp150.8.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libKF5Auth5-64bit-5.45.0-bp150.8.2">
      <FullProductName ProductID="libKF5Auth5-64bit-5.45.0-bp150.8.2">libKF5Auth5-64bit-5.45.0-bp150.8.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libKF5Auth5-lang-5.45.0-bp150.8.2">
      <FullProductName ProductID="libKF5Auth5-lang-5.45.0-bp150.8.2">libKF5Auth5-lang-5.45.0-bp150.8.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpolkit-qt5-1-1-0.112.0-bp150.3.6.1">
      <FullProductName ProductID="libpolkit-qt5-1-1-0.112.0-bp150.3.6.1">libpolkit-qt5-1-1-0.112.0-bp150.3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1">
      <FullProductName ProductID="libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1">libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1">
      <FullProductName ProductID="libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1">libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1">
      <FullProductName ProductID="libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1">libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1</FullProductName>
    </Branch>
    <Relationship ProductReference="kauth-devel-5.45.0-bp150.8.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:kauth-devel-5.45.0-bp150.8.2">kauth-devel-5.45.0-bp150.8.2 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="kauth-devel-64bit-5.45.0-bp150.8.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:kauth-devel-64bit-5.45.0-bp150.8.2">kauth-devel-64bit-5.45.0-bp150.8.2 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libKF5Auth5-5.45.0-bp150.8.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:libKF5Auth5-5.45.0-bp150.8.2">libKF5Auth5-5.45.0-bp150.8.2 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libKF5Auth5-64bit-5.45.0-bp150.8.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:libKF5Auth5-64bit-5.45.0-bp150.8.2">libKF5Auth5-64bit-5.45.0-bp150.8.2 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libKF5Auth5-lang-5.45.0-bp150.8.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:libKF5Auth5-lang-5.45.0-bp150.8.2">libKF5Auth5-lang-5.45.0-bp150.8.2 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpolkit-qt5-1-1-0.112.0-bp150.3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:libpolkit-qt5-1-1-0.112.0-bp150.3.6.1">libpolkit-qt5-1-1-0.112.0-bp150.3.6.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1">libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1">libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Package Hub 15">
      <FullProductName ProductID="SUSE Package Hub 15:libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1">libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1 as a component of SUSE Package Hub 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.</Note>
    </Notes>
    <CVE>CVE-2019-7443</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Package Hub 15:kauth-devel-5.45.0-bp150.8.2</ProductID>
        <ProductID>SUSE Package Hub 15:kauth-devel-64bit-5.45.0-bp150.8.2</ProductID>
        <ProductID>SUSE Package Hub 15:libKF5Auth5-5.45.0-bp150.8.2</ProductID>
        <ProductID>SUSE Package Hub 15:libKF5Auth5-64bit-5.45.0-bp150.8.2</ProductID>
        <ProductID>SUSE Package Hub 15:libKF5Auth5-lang-5.45.0-bp150.8.2</ProductID>
        <ProductID>SUSE Package Hub 15:libpolkit-qt5-1-1-0.112.0-bp150.3.6.1</ProductID>
        <ProductID>SUSE Package Hub 15:libpolkit-qt5-1-1-64bit-0.112.0-bp150.3.6.1</ProductID>
        <ProductID>SUSE Package Hub 15:libpolkit-qt5-1-devel-0.112.0-bp150.3.6.1</ProductID>
        <ProductID>SUSE Package Hub 15:libpolkit-qt5-1-devel-64bit-0.112.0-bp150.3.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>9.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DYXRURFCJ4V45YTWBIHAHA4MX62HBZCX/#DYXRURFCJ4V45YTWBIHAHA4MX62HBZCX</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2019-7443.html</URL>
        <Description>CVE-2019-7443</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1124863</URL>
        <Description>SUSE Bug 1124863</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1170293</URL>
        <Description>SUSE Bug 1170293</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
