Vulnerability in Kde Konqueror

CVE-2004-0411

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.

EPSS: 0.078 (94.0th percentile) — read the EPSS interpretation.

Affected products

Weakness classification (CWE)

References

  • cve@mitre.org (x_refsource_REDHAT, vendor-advisory, Broken Link)
  • cve@mitre.org (vendor-advisory, Broken Link, x_refsource_SUSE)
  • cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
  • cve@mitre.org (x_refsource_FEDORA, vendor-advisory, VDB Entry, Third Party Advisory, Broken Link)
  • cve@mitre.org (Broken Link, Vendor Advisory, mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
  • cve@mitre.org (x_refsource_FEDORA, vendor-advisory, VDB Entry, Third Party Advisory, Broken Link)
  • cve@mitre.org (x_refsource_OSVDB, vdb-entry, Broken Link)
  • cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List, Third Party Advisory)