CVE catalog

CVE-2022-23853

kate: CVE-2022-23853

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.89% · Oct 25, 2026

The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiankatesid4:26.08.2-1fixed
Debiankateforky4:26.08.2-1fixed
Debiankatetrixie4:25.04.3-2fixed
Debiankatebookworm4:22.12.3-1fixed
Debianktexteditorsid5.116.0-1fixed
Debianktexteditorforky5.116.0-1fixed
Debianktexteditortrixie5.116.0-1fixed
Debianktexteditorbookworm5.103.0-1.1fixed
Opensusekatetumbleweed21.12.2-1.1fixed
Suselibqt5-qtbaselinux enterprise module for basesystem 15 sp35.12.7-4.17.1fixed
Suselibqt5-qtbaselinux enterprise module for desktop applications 15 sp35.12.7-4.17.1fixed
Suselibqt5-qtbaselinux enterprise high performance computing 15 sp2-espos5.12.7-4.17.1fixed
Suselibqt5-qtbaselinux enterprise high performance computing 15 sp2-ltss5.12.7-4.17.1fixed
Suselibqt5-qtbaselinux enterprise real time 15 sp25.12.7-4.17.1fixed
Suselibqt5-qtbaselinux enterprise server 15 sp2-bcl5.12.7-4.17.1fixed
Suselibqt5-qtbaselinux enterprise server 15 sp2-ltss5.12.7-4.17.1fixed
Suselibqt5-qtbaselinux enterprise server for sap applications 15 sp25.12.7-4.17.1fixed
Suselibqt5-qtbasemanager proxy 4.15.12.7-4.17.1fixed
Suselibqt5-qtbasemanager retail branch server 4.15.12.7-4.17.1fixed
Suselibqt5-qtbasemanager server 4.15.12.7-4.17.1fixed
Suselibqt5-qtbaseenterprise storage 75.12.7-4.17.1fixed
Opensuselibqt5-qtbasetumbleweed5.15.2+kde294-2.1fixed
Opensuselibqt5-qtbaseleap 15.35.12.7-4.17.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiankatesourcesid4:21.12.2-1not yet assignedNot reportedNot reported
Debiankatesourceforky4:21.12.2-1not yet assignedNot reportedNot reported
Debiankatesourcetrixie4:21.12.2-1not yet assignedNot reportedNot reported
Debiankatesourcebookworm4:21.12.2-1not yet assignedNot reportedNot reported
Debianktexteditorsourcesid5.93.0-1not yet assignedNot reported[1010180]
Debianktexteditorsourceforky5.93.0-1not yet assignedNot reported[1010180]
Debianktexteditorsourcetrixie5.93.0-1not yet assignedNot reported[1010180]
Debianktexteditorsourcebookworm5.93.0-1not yet assignedNot reported[1010180]
Opensusekaterpmtumbleweed21.12.2-1.1Not reportedOPENSUSE-SU-2024:11801-1Not reported
Suselibqt5-qtbaserpmlinux enterprise module for basesystem 15 sp35.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmlinux enterprise module for desktop applications 15 sp35.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmlinux enterprise high performance computing 15 sp2-espos5.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmlinux enterprise high performance computing 15 sp2-ltss5.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmlinux enterprise real time 15 sp25.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmlinux enterprise server 15 sp2-bcl5.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmlinux enterprise server 15 sp2-ltss5.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmlinux enterprise server for sap applications 15 sp25.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmmanager proxy 4.15.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmmanager retail branch server 4.15.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmmanager server 4.15.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Suselibqt5-qtbaserpmenterprise storage 75.12.7-4.17.1Not reportedSUSE-SU-2022:0841-1Not reported
Opensuselibqt5-qtbaserpmtumbleweed5.15.2+kde294-2.1Not reportedOPENSUSE-SU-2024:11813-1Not reported
Opensuselibqt5-qtbaserpmleap 15.35.12.7-4.17.1Not reportedOPENSUSE-SU-2022:0841-1Not reported

[Debian bug #1010180]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [kate-lang]Unknown

    Source package: [kate]

    Details (1)

    • 26.08.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 21.12.2-1.1

      Version impact unknown

      dsa · kate · opensuse · tumbleweed

  • [kate-plugins]Unknown

    Source package: [kate]

    Details (1)

    • 26.08.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 21.12.2-1.1

      Version impact unknown

      dsa · kate · opensuse · tumbleweed

  • [kwrite]Unknown

    Source package: [kate]

    Details (1)

    • 26.08.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 21.12.2-1.1

      Version impact unknown

      dsa · kate · opensuse · tumbleweed

  • [libQt5Bootstrap-devel-static]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Bootstrap-devel-static-32bit]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Concurrent5]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Concurrent5-32bit]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Concurrent-devel]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Concurrent-devel-32bit]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Core5]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Core5-32bit]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Core-devel]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Core-devel-32bit]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Core-private-headers-devel]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · noarch · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5DBus5]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5DBus5-32bit]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5DBus-devel]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5DBus-devel-32bit]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5DBus-private-headers-devel]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · noarch · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

  • [libQt5Gui5]Unknown

    Source package: [libqt5-qtbase]

    Details (1)

    • 5.15.19+kde96-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 5.15.2+kde294-2.1

      Version impact unknown

      dsa · libqt5-qtbase · opensuse · tumbleweed

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]