konqueror XSS

The KDE HTML library kdelibs, as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to...

Moderate: Red Hat Security Advisory: kdebase security update

Updated kdebase packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The kdebase packages provide the core applications for KDE, the K Desktop...

[SECURITY] Fedora 7 Update: kdebase-3.5.7-13.1.fc7

Core applications for the K Desktop Environment. Included are: kdm replacement for xdm, kwin window manager, konqueror filemanager, web browser, ftp client, ..., konsole xterm replacement, kpanel application starter and desktop pager, kaudio audio server, kdehelp viewer for kde help files, info a...

KDE kdm privilege escalation

It's possible to login without password under certain circumstances...

CVE-2007-4569

backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors...

CVE-2007-4569

backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors...

CVE-2007-4569

backend/session.c in KDM in KDE 3.3.0 through 3.5.7, when autologin is configured and "shutdown with password" is enabled, allows remote attackers to bypass the password requirement and login to arbitrary accounts via unspecified vectors...

CVE-2007-4569

CVE-2007-4569 affects KDE kdebase (KDM) where autologin combined with “shutdown with password” enables a local attacker to bypass password protection and login to arbitrary accounts. The primary sources tie this to KDE 3.3.0–3.5.7 and describe the login bypass via unspecified vectors; OpenVAS/Nes...

DSA-1376-1 kdebase - programming error

Bulletin has no description...

kdm -- passwordless login vulnerability

The KDE development team reports: KDM can be tricked into performing a password-less login even for accounts with a password set under certain circumstances, namely autologin to be configured and "shutdown with password" enabled...

konquerer -- address bar spoofing

The KDE development team reports: The Konqueror address bar is vulnerable to spoofing attacks that are based on embedding white spaces in the url. In addition the address bar could be tricked to show an URL which it is intending to visit for a short amount of time instead of the current URL...

Debian DSA-1373-2 : ktorrent - directory traversal

It was discovered that ktorrent, a BitTorrent client for KDE, was vulnerable to a directory traversal bug which potentially allowed remote users to overwrite arbitrary files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

USN-502-1: KDE vulnerabilities

It was discovered that Konqueror could be tricked into displaying incorrect URLs. Remote attackers could exploit this to increase their chances of tricking a user into visiting a phishing URL, which could lead to credential theft...

Qt: Multiple format string vulnerabilities

Background Qt is a cross-platform GUI framework, which is used e.g. by KDE. Description Tim Brown of Portcullis Computer Security Ltd and Dirk Mueller of KDE reported multiple format string errors in qWarning calls in files qtextedit.cpp, qdatatable.cpp, qsqldatabase.cpp, qsqlindex.cpp,...

[SECURITY] Fedora 7 Update: kdelibs-3.5.7-20.fc7

Libraries for the K Desktop Environment: KDE Libraries included: kdecore KDE core library, kdeui user interface, kfm file manager, khtmlw HTML widget, kio Input/Output, networking, kspell spelling checker, jscript javascript, kab addressbook, kimgio image manipulation...

[SECURITY] Fedora 7 Update: koffice-1.6.3-9.fc7

KOffice - Integrated Office Suite KOffice is a free, integrated office suite for KDE, the K Desktop Environme nt...

KDE Konqueror SetInterval函数地址栏URI伪造漏洞

Konqueror是一款多功能的浏览器，允许浏览本地和网络文件系统和全功能的WWW浏览器。 Konqueror不正确过滤用户输入，远程攻击者可以利用漏洞进行URI伪造攻击，获得目标用户敏感信息。 使用较小的间隔值如0使用调用setInterval来更改window.location属性，攻击者可以构建恶意WEB页在地址栏中显示可信URL而内容为任意内容，导致诱使用户信任内容而泄露敏感信息。 KDE Konqueror 3.5.7 KDE Konqueror 3.5.5 目前没有解决方案提供： http://www.konqueror.org/ 可参考如下测试页面：...

Design/Logic Flaw

Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service failed assertion and application crash via certain malformed HTML, as demonstrated by a document containing TEXTAREA, BUTTON, BR, BDO, PRE, FRAMESET, and A tags. NOTE: the provenance ...

CVE-2007-4229

Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service failed assertion and application crash via certain malformed HTML, as demonstrated by a document containing TEXTAREA, BUTTON, BR, BDO, PRE, FRAMESET, and A tags. NOTE: the provenance ...

CVE-2007-4229

Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of service failed assertion and application crash via certain malformed HTML, as demonstrated by a document containing TEXTAREA, BUTTON, BR, BDO, PRE, FRAMESET, and A tags. NOTE: the provenance ...