PT-2004-2110 · Kde+1 · Konqueror+2

Waldo Bastian · Published 2004-12-15 · Updated 2017-10-11 · CVE-2004-1145

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: KDE versions 3.3.1 and earlier

Description: The issue allows access to restricted Java classes via JavaScript and does not properly restrict access to certain Java classes from the Java applet. This enables remote attackers to bypass sandbox restrictions and read or write arbitrary files.

Recommendations: For versions 3.3.1 and earlier, consider disabling JavaScript in Konqueror until a patch is available. Restrict access to Java applets in Konqueror to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-1145

RHSA-2005:065

RHSA-2005_065

Affected Products

Kde

Konqueror

Red Hat

References · 18

• https://bdu.fstec.ru/vul/2015-06212 · Security Note
• https://bdu.fstec.ru/vul/2015-06209 · Security Note
• http://kde.org/info/security/advisory-20041220-1.txt · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200501-16.xml · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-065.html · Vendor Advisory
• http://kb.cert.org/vuls/id/420222 · Patch
• https://bdu.fstec.ru/vul/2015-06210 · Security Note
• http://heise.de/security/dienste/browsercheck/tests/java.shtml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06211 · Security Note
• http://secunia.com/advisories/13586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1145 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2004:154 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2005-065.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18596 · Note
• http://marc.info/?l=bugtraq&m=110356286722875&w=2 · Note