Description
KDE Konqueror 3.5.7 allows remote attackers to spoof the URL address bar by calling setInterval with a small interval and changing the window.location property.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kdebase +1 | 6:3.5.4-15.el5 | RHSA-2007:0905 |
| RHEL 5 | kdelibs +2 | 6:3.5.4-13.el5 | RHSA-2007:0909 |
| RHEL 4 | kdebase +1 | 6:3.3.1-6.el4 | RHSA-2007:0905 |
| RHEL 4 | kdelibs +1 | 6:3.3.1-9.el4 | RHSA-2007:0909 |
Advisories 2
- RHSA-2007:0905 Red Hat Security Advisory: kdebase security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0909 Red Hat Security Advisory: kdelibs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2007:0909 vendor-advisory
- 2982 third-party-advisory
- 27271 third-party-advisory
- FEDORA-2007-716 vendor-advisory
- FEDORA-2007-2361 vendor-advisory
- 20070806 Re: Konqueror: URL address bar spoofing vulnerabilities mailing-list
- RHSA-2007:0905 vendor-advisory
- USN-502-1 vendor-advisory
- 20070806 Re: Konqueror: URL address bar spoofingvulnerabilities mailing-list
- konqueror-setinterval-spoofing(35828) vdb-entry
- ADV-2007-2807 vdb-entry
- 27106 third-party-advisory
- 27108 third-party-advisory
- 26351 third-party-advisory
- 25219 vdb-entry
- 26690 third-party-advisory
- 1018579 vdb-entry
- 27090 third-party-advisory
- SUSE-SR:2007:021 vendor-advisory
- 27089 third-party-advisory
- 26612 third-party-advisory
- 27096 third-party-advisory
- 26720 third-party-advisory
- https://issues.rpath.com/browse/RPL-1615
- MDKSA-2007:176 vendor-advisory
- 20070806 Konqueror: URL address bar spoofing vulnerabilities mailing-list
- http://www.kde.org/info/security/advisory-20070816-1.txt
- 20070807 Re: [Full-disclosure] Konqueror: URL address bar spoofing vulnerabilities mailing-list
- 20070806 Konqueror: URL address bar spoofing vulnerabilities mailing-list
- oval:org.mitre.oval:def:9879 vdb-entry signature