CVE-2005-1920

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The (1) Kate and (2) Kwrite applications in KDE KDE 3.2.x through 3.4.0 do not properly set the same permissions on the backup file as were set on the original file, which could allow local users and possibly remote attackers to obtain sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-281

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=112171434023679&w=2Mailing List
http://secunia.com/advisories/16099Broken Link
http://secunia.com/advisories/23099Broken Link
http://security.gentoo.org/glsa/glsa-200611-21.xmlThird Party Advisory
http://securitytracker.com/id?1014512Broken Link, Third Party Advisory, VDB Entry
http://www.debian.org/security/2005/dsa-804Third Party Advisory
http://www.kde.org/info/security/advisory-20050718-1.txtPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_18_sr.htmlBroken Link
http://www.redhat.com/support/errata/RHSA-2005-612.htmlBroken Link
http://www.securityfocus.com/archive/1/427976/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/14297Broken Link, Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9434Broken Link
http://marc.info/?l=bugtraq&m=112171434023679&w=2Mailing List
http://secunia.com/advisories/16099Broken Link
http://secunia.com/advisories/23099Broken Link
http://security.gentoo.org/glsa/glsa-200611-21.xmlThird Party Advisory
http://securitytracker.com/id?1014512Broken Link, Third Party Advisory, VDB Entry
http://www.debian.org/security/2005/dsa-804Third Party Advisory
http://www.kde.org/info/security/advisory-20050718-1.txtPatch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_18_sr.htmlBroken Link
http://www.redhat.com/support/errata/RHSA-2005-612.htmlBroken Link
http://www.securityfocus.com/archive/1/427976/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/14297Broken Link, Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9434Broken Link

Timeline

Published: Jul 26, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-19217.5Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 CVE-2005-19225.0The MS-Expand file handling in Clam AntiVirus (ClamAV) before 0.86 allows remote attackers to cause a denial of service (file descriptor and CVE-2005-19232.6The ENSURE_BITS macro in mszipd.c for Clam AntiVirus (ClamAV) 0.83, and other versions vefore 0.86, allows remote attackers to cause a denia CVE-2005-19249.3The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharact CVE-2005-19257.5Multiple directory traversal vulnerabilities in Tikiwiki before 1.9.1 allow remote attackers to read arbitrary files and execute commands vi CVE-2005-19287.8Trend Micro ServerProtect EarthAgent for Windows Management Console 5.58 and possibly earlier versions, when running with Trend Micro Contro CVE-2005-19297.5Multiple heap-based buffer overflows in (1) isaNVWRequest.dll and (2) relay.dll in Trend Micro ServerProtect Management Console 5.58 and ear CVE-2005-19305.0Directory traversal vulnerability in the Crystal Report component (rptserver.asp) in Trend Micro ServerProtect Management Console 5.58, as u CVE-2005-19315.0GoodTech SMTP Server 5.14 allows remote attackers to cause a denial of service (application crash) via a RCPT TO command with an invalid arg CVE-2005-19322.1Lpanel 1.59 and earlier, and other versions before 1.597, allows remote authenticated users to modify certain critical variables and (1) mod CVE-2005-19337.5Dashboard in Apple Mac OS X Tiger 10.4 allows attackers to execute arbitrary commands by overriding the behavior of system widgets via a use CVE-2005-19345.0Gaim before 1.3.1 allows remote attackers to cause a denial of service (crash) via a malformed MSN message that leads to a memory allocation