CVE-2014-8600

NameCVE-2014-8600
DescriptionMultiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs769632

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
kde-runtime (PTS)jessie4:4.14.2-2fixed
stretch4:16.08.3-2fixed
buster4:17.08.3-2.1fixed
webkitkde (PTS)jessie, stretch1.3.4-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kde-runtimesource(unstable)4:4.14.2-2769632
kdebase-runtimesource(unstable)(unfixed)
webkitkdesource(unstable)1.3.4-2unimportant

Notes

[wheezy] - kde-runtime <no-dsa> (Minor issue)
[squeeze] - kdebase-runtime <no-dsa> (Minor issue)
webkitpart: http://quickgit.kde.org/?p=kwebkitpart.git&a=commit&h=641aa7c75631084260ae89aecbdb625e918c6689
kde-runtime: http://quickgit.kde.org/?p=kde-runtime.git&a=commit&h=d68703900edc8416fbcd2550cd336cbbb76decb9
Upstream advisory: https://www.kde.org/info/security/advisory-20141113-1.txt
webkit not covered by security support

Search for package or bug name: Reporting problems