PT-2014-8645 · Kde+1 · Kio-Extras+3

Darron Burton + 1 · Publicado 2014-11-20 · Atualizado 2018-10-30 · CVE-2014-8600

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions KDE-Runtime versions 4.14.3 and earlier kwebkitpart versions 1.3.4 and earlier kio-extras versions 5.1.1 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted URI using various schemes, which is not properly handled in an error message. The affected schemes include zip, trash, tar, thumbnail, smtps, smtp, smb, remote, recentdocuments, nntps, nntp, network, mbox, ldaps, ldap, fonts, file, desktop, cgi, bookmarks, or ar.

Recommendations For KDE-Runtime versions 4.14.3 and earlier, consider disabling the handling of crafted URIs using the affected schemes until a patch is available. For kwebkitpart versions 1.3.4 and earlier, restrict access to the vulnerable components to minimize the risk of exploitation. For kio-extras versions 5.1.1 and earlier, avoid using the affected schemes in error messages until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2015-1442

CVE-2014-8600

MGASA-2014-0478

USN-2414-1

Produtos afetados

Alt Linux

Kde-Runtime

Kio-Extras

Kwebkitpart

Referências · 18

• 🔥 https://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Nov/54 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8600 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2015-1442 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=14582 · Nota
• https://advisories.mageia.org/MGASA-2014-0478.html · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2014-8600 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8600 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-8600 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-8600 · Nota de Segurança
• http://securityfocus.com/bid/71190 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1164293 · Nota
• https://ubuntu.com/security/notices/USN-2414-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0478 · Aviso do Fabricante