CVE-2014-8600 Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web sc...
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| urs wolfer kwebkitpart | <= 1.3.3 | No fix listed |
| kde-runtime | <= 4.14.2 | No fix listed |
| KDE kio-extras | <= 5.1.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
References
- openSUSE-SU-2015:0573 vendor-advisory
- 20141119 CVE-2014-8600 - Insufficient Input Validation By IO Slaves In KDE e.V. KDE exploit mailing-list
- USN-2414-1 patch vendor-advisory
- 71190 vdb-entry
- www.portcullis-security.com exploit