kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack.

Security fix for CVE-2018-10380

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fabian Vogt discovered that incorrect permission handling in the PAM module of the KDE Wallet could allow an unprivileged local user to gain ownership of arbitrary files.

This update for pam_kwallet fixes the following issues :

Security issue fixed :

  - CVE-2018-10380: Fix local root vulnerability     (boo#1090863).

ID	Name	Product	Family	Severity
120735	Fedora 28 : pam-kwallet (2018-b8cbd331a1)	Nessus	Fedora Local Security Checks	high
109805	Fedora 27 : pam-kwallet (2018-e56bdde239)	Nessus	Fedora Local Security Checks	high
109803	Fedora 26 : pam-kwallet (2018-a954bb958b)	Nessus	Fedora Local Security Checks	high
109802	Debian DSA-4200-1 : kwallet-pam - security update	Nessus	Debian Local Security Checks	high
109595	openSUSE Security Update : pam_kwallet (openSUSE-2018-423)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-10380

high

Tenable Plugins

high

high

high

high

high