| Name | CVE-2013-2074 |
| Description | kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-952-1 |
| Debian Bugs | 707776 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| kde4libs (PTS) | jessie, jessie (lts) | 4:4.14.2-5+deb8u3 | fixed |
| stretch (lts), stretch | 4:4.14.26-2+deb9u1 | fixed |
| buster | 4:4.14.38-3 | fixed |
The information below is based on the following data on fixed versions.
Notes
[squeeze] - kde4libs <no-dsa> (Minor issue)
https://bugs.kde.org/show_bug.cgi?id=319428
https://github.com/KDE/kdelibs/commit/65d736dab592bced4410ccfa4699de89f78c96ca
https://github.com/KDE/kdelibs/commit/898135a59d91184692ed1bcee8bb4c6d80d6f7b9