CVE-2016-7787: kde kde-cli-tools Code Injection

Vulnerability summary

CVE-2016-7787 is a medium (CVSS 4.9) Code Injection vulnerability in kde kde-cli-tools. EPSS estimates a 1.66% chance of exploitation in the next 30 days, higher than 76.3% of scored vulnerabilities.

Timeline

1. 23-12-2016
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.