CVE-2020-24972

 

Published at: - 29-08-2020 11:15

Last modified: - 16-11-2022 04:12

Total changes: - 2

Description

The Kleopatra component before 3.1.12 (and before 20.07.80) for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://dev.gnupg.org/rKLEOPATRAb4bd63c1739900d94c04da03045e9445a5a5f54b
• https://dev.gnupg.org/source/kleo/browse/master/CMakeLists.txt
• GLSA-202008-21-Third Party Advisory
• FEDORA-2020-9b441d3153-Mailing List, Third Party Advisory
• openSUSE-SU-2020:1723-Broken Link, Mailing List, Third Party Advisory
• openSUSE-SU-2020:1754-Broken Link, Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2020-24972

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures