Unscored severity · published Jul 7, 2004
CVE-2004-0411
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which…
–
CVSS
7.8%
EPSS
No
On KEV
Description
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.8% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KO
Konqueror · Kde
through 3.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0411
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0411
Broken Link
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000843
Mailing List
http://marc.info/?l=bugtraq&m=108481412427344&w=2
Broken Link
http://secunia.com/advisories/11602
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200405-11.xml
Broken Link
http://www.ciac.org/ciac/bulletins/o-146.shtml
Third Party Advisory
http://www.debian.org/security/2004/dsa-518
More from Konqueror
–
CVE-2009-2537
KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to…
–
CVE-2008-5712
The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash) via (1) a long COLOR attribute in an HR element; or a long (a)…
–
CVE-2008-5698
HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of service (application crash) via an invalid document.load call that…
–
CVE-2008-4382
Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service (application crash) via Javascript that calls the alert function with a URL-encoded string of a large…
–
CVE-2007-6591
KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all…