kde kde applications vulnerabilities and exploits

(subscribe to this query)

5

CVSSv2

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover prior to 5.21.3 automatically creates links to potentially dangerous URLs (that are neither https:// nor http://) based on the content of the store.kde.org web site. (5.18.7 is also a fixed version.)

Kde Discover

5

CVSSv2

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications prior to 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value.

Kde Kde Applications

5

CVSSv2

The HTML thumbnailer plugin in KDE Applications prior to 18.12.0 allows malicious users to trigger outbound TCP connections to arbitrary IP addresses, leading to disclosure of the source IP address.

Kde Kde Applications

7.2

CVSSv2

An issue exists in KTextEditor 5.34.0 up to and including 5.45.0. Insecure handling of temporary files in the KTextEditor's kauth_ktexteditor_helper service (as utilized in the Kate text editor) can allow other unprivileged users on the local system to gain root privileges. ...

Kde Ktexteditor

5

CVSSv2

KDE kmail prior to 5.5.2 and messagelib prior to 5.5.2, as distributed in KDE Applications prior to 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote malicious users to obtain sensitive information by ...

Kde Messagelib Kde Kmail

6.8

CVSSv2

ark prior to 16.12.1 might allow remote malicious users to execute arbitrary code via an executable in an archive, related to associated applications.

Fedoraproject Fedora 25 Kde Ark

5

CVSSv2

Directory traversal vulnerability in KArchive prior to 5.24, as used in KDE Frameworks, allows remote malicious users to write to arbitrary files via a ../ (dot dot slash) in a filename in an archive file, related to KNewsstuff downloads.

Canonical Ubuntu Linux 15.10 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 12.04 Kde Karchives

5

CVSSv2

kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for malicious users to guess passwords via a codebook attack.

Kde Kde Applications

6.8

CVSSv2

Mozilla Network Security Services (NSS) prior to 3.12.3, Firefox prior to 3.0.13, Thunderbird prior to 2.0.0.23, and SeaMonkey prior to 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, ...

Mozilla Network Security Services Mozilla Firefox Mozilla Seamonkey Mozilla Thunderbird Suse Linux Enterprise Server 9 Suse Linux Enterprise 11.0 Suse Linux Enterprise 10.0 Opensuse Opensuse Debian Debian Linux 5.0 Canonical Ubuntu Linux 9.04 Canonical Ubuntu Linux 8.10 Canonical Ubuntu Linux 8.04

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook