KDE Security Advisory: Konqueror Cross-Domain Cookie Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: Konqueror Cross-Domain Cookie Injection Original Release Date: 2004-08-23 URL: http://www.kde.org/info/security/advisory-20040823-1.txt 0. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0746 1. Systems affecte...

kdelibs: Cross-domain cookie injection vulnerability

Background KDE is a widely-used desktop environment based on the Qt toolkit. kcookiejar in kdelibs is responsible for storing and managing HTTP cookies. Konqueror uses kcookiejar for storing and managing cookies. Description kcookiejar contains a vulnerability which may allow a malicious website ...

kdelibs -- konqueror cross-domain cookie injection

According to a KDE Security Advisory: WESTPOINT internet reconnaissance services alerted the KDE security team that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. Web sites operating under the affected domains can set HTTP...

Mandrake Linux Security Advisory : qt3 (MDKSA-2004:085)

Chris Evans discovered a heap-based overflow in the QT library when handling 8-bit RLE encoded BMP files. This vulnerability could allow for the compromise of the account used to view or browse malicious BMP files. On subsequent investigation, it was also found that the handlers for XPM, GIF, and...

Mandrake Linux Security Advisory : kdelibs/kdebase (MDKSA-2004:086)

A number of vulnerabilities were discovered in KDE that are corrected with these update packages. The integrity of symlinks used by KDE are not ensured and as a result can be abused by local attackers to create or truncate arbitrary files or to prevent KDE applications from functioning correctly...

Konqueror < 3.1.x Sub-Frames XSS

Binary data 1741.prm...

Konqueror < 3.0.3 Image Handling Overflow DoS

Binary data 1742.prm...

Konqueror < 3.3.2 Multiple Remote Java Sandbox Bypass

Binary data 2529.prm...

kdebase, kdelibs: Multiple security issues

Background KDE is a powerful Free Software graphical desktop environment for Linux and Unix-like Operating Systems. Description KDE contains three security issues: Insecure handling of temporary files when running KDE applications outside of the KDE environment DCOPServer creates temporary files ...

CVE-2004-0527

KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack...

Mandrake Linux Security Advisory : kdelibs (MDKSA-2002:064)

A vulnerability was discovered in Konqueror's cross site scripting protection, in that it fails to initialize the domains on sub-iframes correctly. Because of this, JavaScript may access any foreign subframe which is defined in the HTML source, which can be used to steal cookies from the client a...

CVE-2004-0721

Konqueror 3.1.3, 3.2.2, and possibly other versions does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability...

CVE-2004-0721

Konqueror 3.1.3, 3.2.2, and possibly other versions does not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability...

CVE-2004-0721

CVE-2004-0721 affects Konqueror 3.1.3, 3.2.2 (and possibly other versions) where a frame in one domain can inject content into a frame in another domain, enabling web site spoofing and related attacks. The vulnerability stems from insufficient cross-domain frame isolation, as described in KDE/SUS...

CVE-2004-0411

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a 1 telnet, 2 rlogin, 3 ssh, or 4 mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files...

RHEL 2.1 : kdelibs (RHSA-2003:236)

This erratum provides updated KDE packages that resolve a security issue in Konquerer. KDE is a graphical desktop environment for the X Window System. Konqueror is the file manager for the K Desktop Environment. George Staikos reported that Konqueror may inadvertently send authentication...

RHEL 2.1 : kdelibs (RHSA-2004:074)

Updated kdelibs packages that fix a flaw in cookie path handling are now available. Konqueror is a file manager and Web browser for the K Desktop Environment KDE. Flaws have been found in the cookie path handling between a number of Web browsers and servers. The HTTP cookie standard allows a Web...

CVE-2004-0527

KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF tags with modified "alt" values that point to the legitimate site, combined with an image map whose href points to the malicious site, which facilitates a "phishing" attack...

CVE-2004-0527

CVE-2004-0527 affects KDE Konqueror 2.1.1 and 2.2.2. The issue allows remote attackers to spoof a legitimate URL in the status bar by using A HREF tags with modified alt values that point to the legitimate site, combined with an image map whose href points to the malicious site, enabling a phishi...

CVE-2004-0411

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a 1 telnet, 2 rlogin, 3 ssh, or 4 mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files...