plasma[56]-plasma-workspace -- Unauthorized users can access session manager

2024-05-3100:00:00

vuxml.freebsd.org

plasma-workspace

unauthorized access

session manager

kde

xsmp manager

ice

local connections

session restore

arbitrary code

unix

7.4 High

AI Score

Confidence

Low

JSON

David Edmundson reports:

KSmserver, KDE’s XSMP manager, incorrectly allows connections via ICE
based purely on the host, allowing all local connections. This allows
another user on the same machine to gain access to the session
manager.
A well crafted client could use the session restore feature to execute
arbitrary code as the user on the next boot.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchplasma5-plasma-workspace< 5.27.11.1UNKNOWN
FreeBSDanynoarchplasma6-plasma-workspace< 6.0.4_2UNKNOWN