Description
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kdelibs | 4:2.2.2-13.woody.10 | DSA-518 |
Advisories 1
- DSA-518 kdelibs - unsanitised input Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2004:222 vendor-advisory
- SuSE-SA:2003:014 vendor-advisory
- http://www.kde.org/info/security/advisory-20040517-1.txt
- kde-url-handler-gain-access(16163) vdb-entry
- FEDORA-2004-121 vendor-advisory
- 20040513 Opera Telnet URI Handler Vulnerability also applies to other browsers mailing-list
- DSA-518 vendor-advisory
- FEDORA-2004-122 vendor-advisory
- 6107 vdb-entry
- 20040517 KDE Security Advisory: URI Handler Vulnerabilities mailing-list
- 11602 third-party-advisory
- CLA-2004:843 vendor-advisory
- SSA:2004-238 vendor-advisory
- GLSA-200405-11 vendor-advisory
- oval:org.mitre.oval:def:954 vdb-entry signature
- 10358 vdb-entry
- O-146 third-party-advisory government-resource