Description
The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original file, which could allow local users and possibly remote attackers to obtain sensitive information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kdelibs | 4:3.3.2-6.3 | DSA-804-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kdelibs +1 | 6:3.3.1-3.11 | RHSA-2005:612 |
Advisories 2
- RHSA-2005:612 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-804-2 kdelibs - insecure permissions Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SR:2005:018 vendor-advisory
- 14297 vdb-entry
- oval:org.mitre.oval:def:9434 vdb-entry signature
- DSA-804 vendor-advisory
- 1014512 vdb-entry
- FLSA:178606 vendor-advisory
- 20050718 [KDE Security Advisory]: Kate backup file permission leak mailing-list
- http://www.kde.org/info/security/advisory-20050718-1.txt
- GLSA-200611-21 vendor-advisory
- 16099 third-party-advisory
- 23099 third-party-advisory
- RHSA-2005:612 vendor-advisory