An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a shell command, leading to a possibility of arbitrary command execution. An example of an offending volume label is "$(touch b)" -- this will create a file called b in the home folder.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2018-02-07T02:00:00
Updated: 2024-08-05T06:10:11.363Z
Reserved: 2018-02-06T00:00:00
Link: CVE-2018-6791
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-02-07T02:29:01.453
Modified: 2024-11-21T04:11:12.530
Link: CVE-2018-6791
Redhat