konqueror vulnerabilities and fixes

Recent CVEs affecting konqueror, with upgrade or downgrade steps. 34 tracked.

konqueror has 34 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2009-07-20. Highest priority: CVE-2004-1158 (score 58/100).

• CVE-2009-2537 MEDIUM 4.3 MITIGATE KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer va
• CVE-2008-5712 MEDIUM 5.0 DOWNGRADE The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash
• CVE-2008-5698 MEDIUM 4.3 MITIGATE HTMLTokenizer::scriptHandler in Konqueror in KDE 3.5.9 and 3.5.10 allows remote attackers to cause a denial of
• CVE-2008-4514 MEDIUM 5.0 DOWNGRADE The HTML parser in KDE Konqueror 3.5.9 allows remote attackers to cause a denial of service (application crash
• CVE-2008-4382 MEDIUM 5.0 DOWNGRADE Konqueror in KDE 3.5.9 allows remote attackers to cause a denial of service (application crash) via Javascript
• CVE-2007-6591 MEDIUM 4.3 DOWNGRADE KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain n
• CVE-2007-6000 MEDIUM 5.0 UPGRADE KDE Konqueror 3.5.6 and earlier allows remote attackers to cause a denial of service (crash) via large HTTP co
• CVE-2007-4229 MEDIUM 4.3 UPGRADE Unspecified vulnerability in KDE Konqueror 3.5.7 and earlier allows remote attackers to cause a denial of serv
• CVE-2007-4225 MEDIUM 6.8 DOWNGRADE Visual truncation vulnerability in KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar vi
• CVE-2007-4224 MEDIUM 4.3 DOWNGRADE KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small i
• CVE-2007-3820 LOW 2.6 DOWNGRADE konqueror/konq_combo.cc in Konqueror 3.5.7 allows remote attackers to spoof the data: URI scheme in the addres
• CVE-2007-3143 MEDIUM 6.4 DOWNGRADE Visual truncation vulnerability in Konqueror 3.5.5 allows remote attackers to spoof the address bar and possib
• CVE-2007-2164 MEDIUM 5.0 DOWNGRADE Konqueror 3.5.5 release 45.4 allows remote attackers to cause a denial of service (browser crash or abort) via
• CVE-2007-1565 HIGH 7.8 DOWNGRADE Konqueror 3.5.5 allows remote attackers to cause a denial of service (crash) by using JavaScript to read a chi
• CVE-2007-1564 MEDIUM 6.8 DOWNGRADE The FTP protocol implementation in Konqueror 3.5.5 allows remote servers to force the client to connect to oth
• CVE-2007-1308 MEDIUM 4.3 DOWNGRADE ecma/kjs_html.cpp in KDE JavaScript (KJS), as used in Konqueror in KDE 3.5.5, allows remote attackers to cause
• CVE-2007-0537 LOW 2.6 DOWNGRADE The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allow
• CVE-2006-3672 LOW 2.6 UPGRADE KDE Konqueror 3.5.1 and earlier allows remote attackers to cause a denial of service (application crash) by ca
• CVE-2005-4684 MEDIUM 6.4 DOWNGRADE Konqueror can associate a cookie with multiple domains when the DNS resolver has a non-root domain in its sear
• CVE-2005-0237 MEDIUM 5.0 DOWNGRADE MITIGATE The International Domain Name (IDN) support in Konqueror 3.2.1 on KDE 3.2.1 allows remote attackers to spoof d
• CVE-2004-1165 HIGH 7.5 DOWNGRADE DOWNGRADE Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp:// URL that contains a UR
• CVE-2004-1158 HIGH 7.5 DOWNGRADE MITIGATE Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites
• CVE-2004-0870 MEDIUM 5.0 DOWNGRADE KDE Konqueror does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over
• CVE-2004-0867 HIGH 7.5 DOWNGRADE DOWNGRADE Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk,
• CVE-2004-0866 HIGH 7.5 DOWNGRADE DOWNGRADE Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk,
• CVE-2004-0746 HIGH 7.5 DOWNGRADE MITIGATE Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, suc
• CVE-2004-0721 HIGH 7.5 DOWNGRADE Konqueror 3.1.3, 3.2.2, and possibly other versions does not properly prevent a frame in one domain from injec
• CVE-2004-0527 MEDIUM 5.0 DOWNGRADE KDE Konqueror 2.1.1 and 2.2.2 allows remote attackers to spoof a legitimate URL in the status bar via A HREF t
• CVE-2004-0411 HIGH 7.5 UPGRADE The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hos
• CVE-2003-1478 MEDIUM 4.3 DOWNGRADE Konqueror in KDE 3.0.3 allows remote attackers to cause a denial of service (core dump) via a web page that be
• CVE-2003-0592 HIGH 7.5 DOWNGRADE DOWNGRADE Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended cookie access restrict
• CVE-2003-0459 MEDIUM 5.0 DOWNGRADE DOWNGRADE KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:pass
• CVE-2002-1151 HIGH 7.5 DOWNGRADE MITIGATE The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initial
• CVE-2002-0970 HIGH 7.5 DOWNGRADE MITIGATE The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an interme

FAQ

How do I fix konqueror vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is konqueror being exploited right now?

None of the tracked konqueror CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which konqueror CVE should I patch first?

CVE-2004-1158 currently ranks highest (58/100): Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to spoof arbitrary web sites.

RSS feed for konqueror · ← Back to latest CVEs