{"id":"UBUNTU-CVE-2020-27187","details":"An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related commands, while KDE Partition Manager is running. the mount command can then be used to gain full root privileges.","modified":"2026-04-22T12:37:04.236983Z","published":"2020-10-26T17:15:00Z","upstream":["CVE-2020-27187"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-27187"},{"type":"REPORT","url":"https://kde.org/info/security/advisory-20201017-1.txt"},{"type":"REPORT","url":"https://invent.kde.org/system/kpmcore/-/commit/c466c5db11b5cee546d1ec0594c2f1105a354fed"},{"type":"REPORT","url":"https://invent.kde.org/system/kpmcore/-/commit/7ec4b611dcf822439b081613cca4184689266454"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1890199"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2020-27187"}],"affected":[{"package":{"name":"kpmcore","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/kpmcore@3.3.0-2ubuntu1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2-1","3.2.0-2","3.2.1-2ubuntu1","3.2.1-3","3.3.0-2","3.3.0-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_version":"3.3.0-2ubuntu1","binary_name":"libkpmcore7"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-27187.json"}},{"package":{"name":"kpmcore","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/kpmcore@4.1.0-2?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.0-5","4.0.1-2","4.1.0-0ubuntu1","4.1.0-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libkpmcore9","binary_version":"4.1.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-27187.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}