| Name | CVE-2014-8600 |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 769632 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| kde-runtime (PTS) | jessie | 4:4.14.2-2 | fixed |
| stretch | 4:16.08.3-2 | fixed | |
| buster | 4:17.08.3-2.1 | fixed | |
| webkitkde (PTS) | jessie, stretch | 1.3.4-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| kde-runtime | source | (unstable) | 4:4.14.2-2 | 769632 | ||
| kdebase-runtime | source | (unstable) | (unfixed) | |||
| webkitkde | source | (unstable) | 1.3.4-2 | unimportant |
[wheezy] - kde-runtime <no-dsa> (Minor issue)
[squeeze] - kdebase-runtime <no-dsa> (Minor issue)
webkitpart: http://quickgit.kde.org/?p=kwebkitpart.git&a=commit&h=641aa7c75631084260ae89aecbdb625e918c6689
kde-runtime: http://quickgit.kde.org/?p=kde-runtime.git&a=commit&h=d68703900edc8416fbcd2550cd336cbbb76decb9
Upstream advisory: https://www.kde.org/info/security/advisory-20141113-1.txt
webkit not covered by security support