Debian DSA-155-1 : kdelibs - privacy escalation with Konqueror

Due to a security engineering oversight, the SSL library from KDE, which Konqueror uses, doesn't check whether an intermediate certificate for a connection is signed by the certificate authority as safe for the purpose, but accepts it when it is signed. This makes it possible for anyone with a...

Debian DSA-539-1 : kdelibs - temporary directory vulnerability

The SUSE security team was alerted that in some cases the integrity of symlinks used by KDE are not ensured and that these symlinks can be pointing to stale locations. This can be abused by a local attacker to create or truncate arbitrary files or to prevent KDE applications from functioning...

Debian DSA-204-1 : kdelibs - arbitrary program execution

The KDE team has discovered a vulnerability in the support for various network protocols via the KIO. The implementation of the rlogin and telnet protocols allows a carefully crafted URL in an HTML page, HTML email or other KIO-enabled application to execute arbitrary commands on the system using...

Debian DSA-296-1 : kdebase - insecure execution

The KDE team discovered a vulnerability in the way KDE uses Ghostscript software for processing of PostScript PS and PDF files. An attacker could provide a malicious PostScript or PDF file via mail or websites that could lead to executing arbitrary commands under the privileges of the user viewin...

Debian DSA-167-1 : kdelibs - XSS

A cross site scripting problem has been discovered in Konqueror, a famous browser for KDE and other programs using KHTML. The KDE team reportsthat Konqueror's cross site scripting protection fails to initialize the domains on sub-iframes correctly. As a result, JavaScript is able to access any...

Debian DSA-235-1 : kdegraphics - several vulnerabilities

The KDE team discovered several vulnerabilities in the K Desktop Environment. In some instances KDE fails to properly quote parameters of instructions passed to a command shell for execution. These parameters may incorporate data such as URLs, filenames and e-mail addresses, and this data may be...

CVE-2004-0690

The DCOPServer in KDE 3.2.3 and earlier allows local users to gain unauthorized access via a symlink attack on DCOP files in the /tmp directory...

CVE-2004-0689

KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary files...

CVE-2004-0870

KDE Konqueror does not prevent cookies that are sent over an insecure channel HTTP from also being sent over a secure channel HTTPS/SSL in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."...

CVE-2004-0746

CVE-2004-0746 affects Konqueror in KDE 3.2.3 and earlier. The issue allows a remote attacker to cause a web site to set cookies for country-specific top‑level domains (for example .ltd.uk, .plc.uk, .firm.in), enabling a session fixation attack and potential HTTP session hijacking. Connected docum...

CVE-2004-0690

CVE-2004-0690 : The DCOPServer in KDE 3.2.3 and earlier is vulnerable to a local symlink attack in the /tmp directory that allows an attacker to gain unauthorized access. The issue is rooted in symlink handling rather than remote code execution; local access with low privilege is implied. Public ...

CVE-2004-0690

The DCOPServer in KDE 3.2.3 and earlier allows local users to gain unauthorized access via a symlink attack on DCOP files in the /tmp directory...

Fedora Core 2 : kdelibs-3.2.2-8.FC2 (2004-291)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

Fedora Core 1 : kdebase-3.1.4-7 (2004-292)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

Fedora Core 2 : kdebase-3.2.2-6.FC2 (2004-293)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

Fedora Core 1 : kdelibs-3.1.4-7 (2004-290)

Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities...

KDE DCOPServer insecurely creates temporary files

Overview KDE DCOPServer insecurely creates and maintains temporary files used for authentication purposes. Unauthorized local users may be able to modify user account information and execute arbitrary commands with the privileges of the compromised account. Description The Desktop COmmunications...

[slackware-security] kde

New kdelibs and kdebase packages are available for Slackware 9.1, 10.0, and -current to fix security issues. More details about this issues may be found in the Common Vulnerabilities and Exposures CVE database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0689...

CVE-2003-0988

Buffer overflow in the VCF file information reader for KDE Personal Information Management kdepim suite in KDE 3.1.0 through 3.1.4 allows attackers to execute arbitrary code via a VCF file...

CVE-2002-1151

CVE-2002-1151 affects Konqueror in KDE 2.2.2 and 3.0–3.0.3, where Konqueror’s cross-site scripting protection fails to correctly initialize domains on sub-frames/sub-iframes. This can allow remote attackers to run script and steal cookies from subframes that are in other domains. The issue is tie...