PT-2020-8646 · Kde+1 · Kde Applications+1

Published 2018-12-03 · Updated 2020-03-18 · CVE-2018-19516

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: KDE Applications versions prior to 18.12.0

Description: The issue arises from the improper restriction of handling an http-equiv="REFRESH" value in the messagepartthemes/default/defaultrenderer.cpp file within messagelib in KDE Applications. This could potentially lead to unintended behavior.

Recommendations: For versions prior to 18.12.0, update to version 18.12.0 or later to resolve the issue. As a temporary workaround, consider restricting the handling of http-equiv="REFRESH" values in the defaultrenderer.cpp file until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-19516

MGASA-2018-0476

OPENSUSE-SU-2018_4029-1

Affected Products

Kde Applications

Suse

References · 15

• https://osv.dev/vulnerability/MGASA-2018-0476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19516 · Security Note
• https://osv.dev/vulnerability/CVE-2018-19516 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19516 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-19516 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19516 · Vendor Advisory
• https://cgit.kde.org/messagelib.git/commit/messageviewer/src/messagepartthemes/default/defaultrenderer.cpp?id=34765909cdf8e55402a8567b48fb288839c61612 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19516 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-19516 · Security Note
• https://advisories.mageia.org/MGASA-2018-0476.html · Security Note
• https://t.me/cibsecurity/10484 · Telegram Post
• https://bugs.mageia.org/show_bug.cgi?id=23923 · Note
• https://t.me/cvenotify/1608 · Telegram Post
• https://cgit.kde.org/messagelib.git/commit/?id=34765909cdf8e55402a8567b48fb288839c61612 · Note
• https://kde.org/info/security/advisory-20181128-1.txt · Note