Description
Unknown vulnerability in the rlogin KIO subsystem (rlogin.protocol) of KDE 2.x 2.1 and later, and KDE 3.x 3.0.4 and earlier, allows local and remote attackers to execute arbitrary code via a certain URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kdelibs | 2.2.2-13.woody.5 | DSA-204 |
Advisories 1
- DSA-204 kdelibs - arbitrary program execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- kde-rlogin-command-execution(10602) vdb-entry
- 20021114 GLSA: kdelibs mailing-list
- 8298 third-party-advisory
- http://www.kde.org/info/security/advisory-20021111-1.txt
- MDKSA-2002:079 vendor-advisory
- 20021112 KDE Security Advisory: rlogin.protocol and telnet.protocol URL KIO Vulnerability mailing-list
- DSA-204 vendor-advisory
- RHSA-2002:220 vendor-advisory
- 6182 vdb-entry