CVE-2019-7443

Name	CVE-2019-7443
Description	KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. In other words, KAuth unintentionally causes this plugin code to run as root, which increases the severity of any possible exploitation of a plugin vulnerability.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	921995, 922727

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
kauth (PTS)	buster	5.54.0-2	fixed
	bullseye	5.78.0-2	fixed
	bookworm	5.103.0-1	fixed
	sid, trixie	5.107.0-1	fixed
kde4libs (PTS)	buster	4:4.14.38-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
kauth	source	stretch	5.28.0-2+deb9u1
kauth	source	(unstable)	5.54.0-2	921995
kde4libs	source	(unstable)	(unfixed)	922727

Notes

[buster] - kde4libs <ignored> (Minor issue)
[stretch] - kde4libs <ignored> (Minor issue)
[jessie] - kde4libs <no-dsa> (Minor issue)
https://mail.kde.org/pipermail/kde-announce/2019-February/000011.html
https://github.com/KDE/kauth/commit/fc70fb0161c1b9144d26389434d34dd135cd3f4a