Description
The KDE HTML library (kdelibs), as used by Konqueror 3.5.5, does not properly parse HTML comments, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within a comment in a title tag, a related issue to CVE-2007-0478.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdelibs +2 | 6:3.5.4-13.el5 | RHSA-2007:0909 |
| RHEL 4 | kdelibs +1 | 6:3.3.1-9.el4 | RHSA-2007:0909 |
Advisories 1
- RHSA-2007:0909 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2007:0909 vendor-advisory
- MDKSA-2007:157 vendor-advisory
- 24889 third-party-advisory
- 23932 third-party-advisory
- SUSE-SR:2007:006 vendor-advisory
- http://www.kde.org/info/security/advisory-20070206-1.txt
- 32975 vdb-entry
- GLSA-200703-10 vendor-advisory
- 20070124 Re: Safari Improperly Parses HTML Documents & BlogSpot XSS vulnerability mailing-list
- USN-420-1 vendor-advisory
- 27108 third-party-advisory
- https://issues.rpath.com/browse/RPL-1117
- 24463 third-party-advisory
- 1017591 vdb-entry
- 24065 third-party-advisory
- 24013 third-party-advisory
- oval:org.mitre.oval:def:10244 vdb-entry signature
- MDKSA-2007:031 vendor-advisory
- ADV-2007-0505 vdb-entry
- 22428 vdb-entry
- 24442 third-party-advisory