Description
The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does not properly initialize the domains on sub-frames and sub-iframes, which can allow remote attackers to execute script and steal cookies from subframes that are in other domains.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kdelibs | 4:2.2.2-13.woody.3 | DSA-167 |
Advisories 1
- DSA-167 kdelibs - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2002:220 vendor-advisory
- http://www.kde.org/info/security/advisory-20020908-2.txt
- ie-sameoriginpolicy-bypass(10039) vdb-entry
- MDKSA-2002:064 vendor-advisory
- DSA-167 vendor-advisory
- RHSA-2002:221 vendor-advisory
- CLA-2002:525 vendor-advisory
- 5689 vdb-entry
- 7867 vdb-entry
- 20020910 KDE Security Advisory: Konqueror Cross Site Scripting Vulnerability mailing-list