security flaw

Konqueror 3.1.3, 3.2.2, and possibly other versions does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability...

Moderate: Red Hat Security Advisory: kdelibs, kdebase security update

Updated kdelib and kdebase packages that resolve multiple security issues are now available. The kdelibs packages include libraries for the K Desktop Environment. The kdebase packages include core applications for the K Desktop Environment. Andrew Tuitt reported that versions of KDE up to and...

FreeBSD Ports : Multiple Browsers Frame Injection

The remote host is running one of the following package : kdelibs 3.2.33 kdebase 3.2.31 7.50 = linux-opera 7.52 7.50 = opera 7.52 firefox 0.9 linux-mozilla 1.7 linux-mozilla-devel 1.7 mozilla-gtk1 1.7 mozilla 1.7,2 netscape7 7.2 These packages contain a bug which may allow an attacker to perform ...

Fedora Core 1 : kdebase-3.1.4-7 (2004-292)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

Fedora Core 2 : kdebase-3.2.2-6.FC2 (2004-293)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

Fedora Core 2 : kdelibs-3.2.2-8.FC2 (2004-291)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

Fedora Core 1 : kdelibs-3.1.4-7 (2004-290)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

mpg123 buffer overflow

Stack overflow on mp3 frame processing in syncstream function...

[slackware-security] kde

New kdelibs and kdebase packages are available for Slackware 9.1, 10.0, and -current to fix security issues. More details about this issues may be found in the Common Vulnerabilities and Exposures CVE database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0689...

GLSA-200408-13 : kdebase, kdelibs: Multiple security issues

The remote host is affected by the vulnerability described in GLSA-200408-13 kdebase, kdelibs: Multiple security issues KDE contains three security issues: Insecure handling of temporary files when running KDE applications outside of the KDE environment DCOPServer creates temporary files in an...

GLSA-200407-15 : Opera: Multiple spoofing vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200407-15 Opera: Multiple spoofing vulnerabilities Opera fails to remove illegal characters from an URI of a link and to check that the target frame of a link belongs to the same website as the link. Opera also updates the address...

Mandrake Linux Security Advisory : kdelibs/kdebase (MDKSA-2004:086)

A number of vulnerabilities were discovered in KDE that are corrected with these update packages. The integrity of symlinks used by KDE are not ensured and as a result can be abused by local attackers to create or truncate arbitrary files or to prevent KDE applications from functioning correctly...

Mandrake Linux Security Advisory : mozilla (MDKSA-2004:082)

A number of security vulnerabilities in mozilla are addressed by this update for Mandrakelinux 10.0 users, including a fix for frame spoofing, a fixed popup XPInstall/security dialog bug, a fix for untrusted chrome calls, a fix for SSL certificate spoofing, a fix for stealing secure HTTP Auth...

Mozilla Firefox < 1.7.1 Cross-Domain Frame Loading Vulnerability (deprecated)

Binary data 1772.prm...

kdebase, kdelibs: Multiple security issues

Background KDE is a powerful Free Software graphical desktop environment for Linux and Unix-like Operating Systems. Description KDE contains three security issues: Insecure handling of temporary files when running KDE applications outside of the KDE environment DCOPServer creates temporary files ...

KDE Security Advisories: Temporary File and Konqueror Frame Injection Vulnerabilities

Three security advisories have been issued today for KDE. The first advisory concerns the unsafe handling of KDE's temporary directory in certain circumstances. The second advisory relates to the unsafe creation of temporary files by KDE 3.2.x's dcopserver . The third advisory is about a frame...

Multiple KDE bugs

Multiple symbolic links problems, Konqueror frame spoofing...

Mutiple browser frame injection vulnerability

A class of bugs affecting many web browsers in the same way was discovered. A Secunia advisory reports: The problem is that the browsers don't check if a target frame belongs to a website containing a malicious link, which therefore doesn't prevent one browser window from loading content in a nam...

CVE-2004-0719

Internet Explorer for Mac 5.2.3, Internet Explorer 6 on Windows XP, and possibly other versions, does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection...

CVE-2004-0718

The 1 Mozilla 1.6, 2 Firebird 0.7, 3 Firefox 0.8, and 4 Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability...