CVE-2009-2702

CVE-2009-2702 affects KDE KSSL in kdelibs (versions 3.5.4, 4.2.4, 4.3). The issue is improper handling of a '\0' character in the domain name within the Subject Alternative Name (SAN) field of an X.509 certificate, enabling MITM attackers to spoof SSL servers via a certificate issued by a trusted...

CVE-2017-8422

KDE kauth and kdelibs contain a local privilege escalation flaw: a callerID spoof via D-Bus in KAuth and KDELibs can let a non-privileged user gain root. Affected: kde4libs/kdelibs before 4.14.32 and KAuth before 5.34. Impact: local attacker could escalate privileges; no remote/vector details pro...

CVE-2014-5033

CVE-2014-5033 affects KDE components: kdelibs prior to 4.14 and kauth prior to 5.1, where PolicyKit is accessed via D-Bus. A local race condition in PolkitUnixProcess/PolkitSubject could allow bypassing authorization, related to PID-reuse issues (and CVE-2013-4288). Public documents show mitigati...

CVE-2017-6410

Affected components: KDE kio (kpac/script.cpp) before 5.32 and kde4libs before 4.14.30. Root cause / flaw: PAC FindProxyForURL called with a full HTTPS URL, potentially including Basic Auth credentials, a query string, or PATH_INFO, enabling leakage of sensitive information via crafted PAC files....

CVE-2015-7543

CVE-2015-7543 affects aRts 1.5.10 and kdelibs3 3.5.10 and earlier. The issue stems from insecure creation of temporary directories, allowing a local attacker to hijack IPC by pre-creating the temporary directory. Several advisories note this vulnerability and provide patches/remediations: SUSE-SU...

CVE-2004-1165

CVE-2004-1165 affects Konqueror 3.3.1, where a crafted ftp:// URL containing a URL-encoded newline (%0a) can inject FTP commands (e.g., PORT) into the session. Exploitation would occur via remote interaction with the FTP handling code within Konqueror. Public advisories reference kdelibs/kdebase ...

CVE-2013-2074

CVE-2013-2074 affects kioslave/http/http.cpp in KIO (kdelibs) 4.10.3 and earlier. A crafted request can trigger an internal server error that includes the username and password in the error message, exposing credentials and impacting confidentiality. Connected sources (e.g., Debian DLA-952-1 and ...

CVE-2014-3494

KDE kdelibs 4.10.95 before 4.13.3 vulnerable in its POP3 kioslave (kmail/kio) to MITM via invalid SSL certificates, causing leakage of authentication data and email contents. The root cause is improper certificate handling in the POP3 kioslave. Public advisories and OpenVAS/Nessus entries (e.g., ...