CVE-2004-1145 Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier (1) allow access to restricted Java classes via JavaScript and (2) do not properly restrict access to certain Java classes from the Java....
MediumCVSS 5.0
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple vulnerabilities in Konqueror in KDE 3.3.1 and earlier (1) allow access to restricted Java classes via JavaScript and (2) do not properly restrict access to certain Java classes from the Java applet, which allows remote attackers to bypass sandbox restrictions and read or write arbitrary files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ethereal group ethereal | = 0.9 | No fix listed |
| ethereal group ethereal | = 0.9.1 | No fix listed |
| ethereal group ethereal | = 0.9.2 | No fix listed |
| ethereal group ethereal | = 0.9.3 | No fix listed |
| ethereal group ethereal | = 0.9.4 | No fix listed |
| ethereal group ethereal | = 0.9.5 | No fix listed |
| ethereal group ethereal | = 0.9.6 | No fix listed |
| ethereal group ethereal | = 0.9.7 | No fix listed |
| ethereal group ethereal | = 0.9.8 | No fix listed |
| ethereal group ethereal | = 0.9.9 | No fix listed |
| ethereal group ethereal | = 0.9.10 | No fix listed |
| ethereal group ethereal | = 0.9.11 | No fix listed |
| ethereal group ethereal | = 0.9.12 | No fix listed |
| ethereal group ethereal | = 0.9.13 | No fix listed |
| ethereal group ethereal | = 0.9.14 | No fix listed |
| ethereal group ethereal | = 0.9.15 | No fix listed |
| ethereal group ethereal | = 0.9.16 | No fix listed |
| ethereal group ethereal | = 0.10 | No fix listed |
| ethereal group ethereal | = 0.10.1 | No fix listed |
| ethereal group ethereal | = 0.10.2 | No fix listed |
| ethereal group ethereal | = 0.10.3 | No fix listed |
| ethereal group ethereal | = 0.10.4 | No fix listed |
| ethereal group ethereal | = 0.10.5 | No fix listed |
| ethereal group ethereal | = 0.10.6 | No fix listed |
| ethereal group ethereal | = 0.10.7 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sgi propack | = 3.0 | No fix listed |
| conectiva linux | = 9.0 | No fix listed |
| conectiva linux | = 10.0 | No fix listed |
| altlinux alt linux | = 2.3 | No fix listed |
| debian linux | = 3.0 | No fix listed |
| redhat enterprise linux | = 2.1 | No fix listed |
| redhat enterprise linux | = 3.0 | No fix listed |
| redhat enterprise linux desktop | = 3.0 | No fix listed |
| redhat linux advanced workstation | = 2.1 | No fix listed |
| suse linux | = 8.0 | No fix listed |
| suse linux | = 8.1 | No fix listed |
| suse linux | = 8.2 | No fix listed |
| suse linux | = 9.0 | No fix listed |
| suse linux | = 9.1 | No fix listed |
| suse linux | = 9.2 | No fix listed |
References
- 20041220 KDE Security Advisory: Konqueror Java Vulnerability mailing-list
- 13586 patch third-party-advisory vendor-advisory
- GLSA-200501-16 patch vendor-advisory
- www.heise.de vendor-advisory
- VU#420222 patch third-party-advisory us-government-resource
- www.kde.org patch vendor-advisory
- MDKSA-2004:154 vendor-advisory
- RHSA-2005:065 patch vendor-advisory
- konqueror-sandbox-restriction-bypass(18596) vdb-entry
- oval:org.mitre.oval:def:10173 signature vdb-entry