Vulnerability CVE-2011-1168


Published: 2011-04-18   Modified: 2012-02-13

Description:
Cross-site scripting (XSS) vulnerability in the KHTMLPart::htmlError function in khtml/khtml_part.cpp in Konqueror in KDE SC 4.4.0 through 4.6.1 allows remote attackers to inject arbitrary web script or HTML via the URI in a URL corresponding to an unavailable web site.

See advisories in our WLB2 database:
Topic
Author
Date
Low
Medium severity flaw in Konqueror
Tim Brown
20.04.2011

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

Vendor: KDE
Product: Kde sc 
Version:
4.6.1
4.6.0
4.6
4.5.5
4.5.4
4.5.3
4.5.2
4.5.1
4.5.0
4.4.5
4.4.4
4.4.3
4.4.2
4.4.1
4.4.0

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
http://securityreason.com/securityalert/8208
http://securitytracker.com/id?1025322
http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.329727
http://www.kde.org/info/security/advisory-20110411-1.txt
http://www.mandriva.com/security/advisories?name=MDVSA-2011:075
http://www.nth-dimension.org.uk/pub/NDSA20110321.txt.asc
http://www.securityfocus.com/archive/1/517432/100/0/threaded
http://www.securityfocus.com/archive/1/517433/100/0/threaded
http://www.securityfocus.com/bid/47304
http://www.ubuntu.com/usn/USN-1110-1
http://www.vupen.com/english/advisories/2011/0927
http://www.vupen.com/english/advisories/2011/0928
http://www.vupen.com/english/advisories/2011/0990
https://bugzilla.redhat.com/show_bug.cgi?id=695398
https://exchange.xforce.ibmcloud.com/vulnerabilities/66697

Related CVE
CVE-2019-7443
KDE KAuth before 5.55 allows the passing of parameters with arbitrary types to helpers running as root over DBus via DBusHelperProxy.cpp. Certain types can cause crashes, and trigger the decoding of arbitrary images with dynamically loaded plugins. I...
CVE-2019-10732
In KDE KMail 5.2.3, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipa...
CVE-2018-19120
The HTML thumbnailer plugin in KDE Applications before 18.12.0 allows attackers to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.
CVE-2018-1000801
okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via...
CVE-2017-17689
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
CVE-2018-10361
An issue was discovered in KTextEditor 5.34.0 through 5.45.0. Insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to g...
CVE-2018-6791
An issue was discovered in soliduiserver/deviceserviceaction.cpp in KDE Plasma Workspace before 5.12.0. When a vfat thumbdrive that contains `` or $() in its volume label is plugged in and mounted through the device notifier, it's interpreted as a sh...
CVE-2018-6790
An issue was discovered in KDE Plasma Workspace before 5.12.0. dataengines/notifications/notificationsengine.cpp allows remote attackers to discover client IP addresses via a URL in a notification, as demonstrated by the src attribute of an IMG eleme...

Copyright 2019, cxsecurity.com

 

Back to Top