Description
Konqueror in KDE 3.2.3 and earlier allows web sites to set cookies for country-specific top-level domains, such as .ltd.uk, .plc.uk and .firm.in, which could allow remote attackers to perform a session fixation attack and hijack a user's HTTP session.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kdebase +1 | 6:3.1.3-5.4 | RHSA-2004:412 |
| RHEL 3 | kdelibs +1 | 6:3.1.3-6.6 | RHSA-2004:412 |
Advisories 1
- RHSA-2004:412 Red Hat Security Advisory: kdelibs, kdebase security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 12341 third-party-advisory
- kde-konqueror-cookie-set(17063) vdb-entry
- CLA-2004:864 vendor-advisory
- MDKSA-2004:086 vendor-advisory
- 10991 vdb-entry
- http://www.kde.org/info/security/advisory-20040823-1.txt
- oval:org.mitre.oval:def:11281 vdb-entry signature
- 20040823 KDE Security Advisory: Konqueror Cross-Domain Cookie Injection mailing-list