Published: 08/12/2014 Updated: 30/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and previous versions, kwebkitpart 1.3.4 and previous versions, and kio-extras 5.1.1 and previous versions allow remote malicious users to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.

Vulnerable Product	Search on Vulmon	Subscribe to Product
urs wolfer kwebkitpart
kde kde-runtime
kde kio-extras
opensuse opensuse 13.1

Debian Bug report logs - #769632 kde-runtime: CVE-2014-8600: Insufficient Input Validation By IO Slaves and Webkit Part Package: src:kde-runtime; Maintainer for src:kde-runtime is Debian/Kubuntu Qt/KDE Maintainers <debian-qt-kde@listsdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 15 Nov ...

KDE-Runtime could be made to run arbitrary javascript ...

Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4143 and earlier, kwebkitpart 134 and earlier, and kio-extras 511 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (1 ...

It was discovered that a number of the protocol handlers (referred to as IO slaves) did not satisfactorily handle malicious input It is possible for an attacker to inject JavaScript by manipulating IO slave URI such that the JavaScript from the manipulated request is returned in the response ...

CWE-79 http://www.securityfocus.com/bid/71190 http://seclists.org/fulldisclosure/2014/Nov/54 http://ubuntu.com/usn/usn-2414-1 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600/http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769632 https://usn.ubuntu.com/2414-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-8600

CVE-2014-8600

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect