CVE-2004-0411
- State
- Published
- Severity
- Not scored
- Published
- May 20, 2004
- Updated
- Aug 8, 2024
- Reserved
- Apr 16, 2004
Description
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2004:222vendor-advisory
- SuSE-SA:2003:014vendor-advisory
- http://www.kde.org/info/security/advisory-20040517-1.txt
- kde-url-handler-gain-access(16163)vdb-entry
- FEDORA-2004-121vendor-advisory
- 20040513 Opera Telnet URI Handler Vulnerability also applies to other browsersmailing-list
- DSA-518vendor-advisory
- FEDORA-2004-122vendor-advisory
- 6107vdb-entry
- 20040517 KDE Security Advisory: URI Handler Vulnerabilitiesmailing-list
- 11602third-party-advisory
- CLA-2004:843vendor-advisory
- SSA:2004-238vendor-advisory
- GLSA-200405-11vendor-advisory
- oval:org.mitre.oval:def:954vdb-entrysignature
- 10358vdb-entry
- O-146third-party-advisorygovernment-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.