PT-2014-8645 · Kde+1 · Kio-Extras+3

Darron Burton + 1 · Published 2014-11-20 · Updated 2018-10-30 · CVE-2014-8600

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions KDE-Runtime versions 4.14.3 and earlier kwebkitpart versions 1.3.4 and earlier kio-extras versions 5.1.1 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted URI using various schemes, which is not properly handled in an error message. The affected schemes include zip, trash, tar, thumbnail, smtps, smtp, smb, remote, recentdocuments, nntps, nntp, network, mbox, ldaps, ldap, fonts, file, desktop, cgi, bookmarks, or ar.

Recommendations For KDE-Runtime versions 4.14.3 and earlier, consider disabling the handling of crafted URIs using the affected schemes until a patch is available. For kwebkitpart versions 1.3.4 and earlier, restrict access to the vulnerable components to minimize the risk of exploitation. For kio-extras versions 5.1.1 and earlier, avoid using the affected schemes in error messages until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2015-1442

CVE-2014-8600

MGASA-2014-0478

USN-2414-1

Affected Products

Alt Linux

Kde-Runtime

Kio-Extras

Kwebkitpart

References · 18

• 🔥 https://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-8600 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Nov/54 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8600 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-1442 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0478.html · Security Note
• https://cve.org/CVERecord?id=CVE-2014-8600 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8600 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8600 · Security Note
• https://ubuntu.com/security/notices/USN-2414-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00068.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0478 · Vendor Advisory
• http://ubuntu.com/usn/usn-2414-1 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=14582 · Note
• http://securityfocus.com/bid/71190 · Note