PT-2014-1878 · Kde · Kdelibs

Vincent Danen · Published 2014-02-05 · Updated 2014-06-29 · CVE-2013-2074

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions kdelibs versions 4.10.3 and earlier kdelibs versions prior to 4.12.5-r1

Description The issue allows attackers to discover credentials via a crafted request that triggers an internal server error, which includes the username and password in an error message. Multiple vulnerabilities in the kdelibs package can lead to a breach of protected information, and exploitation can be carried out remotely.

Recommendations For kdelibs versions 4.10.3 and earlier, update to a version later than 4.10.3. For kdelibs versions prior to 4.12.5-r1, update to version 4.12.5-r1 or later.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

BDU:2015-09700

CVE-2013-2074

DLA-952-1

OPENSUSE-SU-2024:10394-1

Affected Products

Kdelibs

References · 13

• https://bugs.kde.org/show_bug.cgi?id=319428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2074 · Security Note
• https://osv.dev/vulnerability/CVE-2013-2074 · Vendor Advisory
• http://ubuntu.com/usn/usn-1842-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09700 · Security Note
• http://openwall.com/lists/oss-security/2013/05/10/4 · Note
• https://projects.kde.org/projects/kde/kdelibs/repository/revisions/65d736dab592bced4410ccfa4699de89f78c96ca/diff/kioslave/http/http.cpp · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776 · Note
• http://security.gentoo.org/glsa/glsa-201406-34.xml · Note
• http://osvdb.org/93244 · Note
• http://xorl.wordpress.com/2013/05/22/cve-2013-2074-kde-kdelibs-password-exposure · Note
• http://openwall.com/lists/oss-security/2013/05/11/2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=961981 · Note