CVE-2014-8600

2014-11-2000:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.003

Percentile

70.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3
and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and
earlier allow remote attackers to inject arbitrary web script or HTML via a
crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5)
smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11)
nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17)
file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is
not properly handled in an error message.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchkde-runtime< 4:4.8.5-0ubuntu0.3UNKNOWN
ubuntu14.04noarchkde-runtime< 4:4.13.3-0ubuntu0.2UNKNOWN
ubuntu14.10noarchkde-runtime< 4:4.14.1-0ubuntu1.1UNKNOWN
ubuntu12.04noarchwebkitkde< 1.1.0git80efcf77-1ubuntu1UNKNOWN
ubuntu14.04noarchwebkitkde< 1.3~git20120518.9a111005-3ubuntu1UNKNOWN
ubuntu14.10noarchwebkitkde< 1.3.4-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	kde-runtime	< 4:4.8.5-0ubuntu0.3	UNKNOWN
ubuntu	14.04	noarch	kde-runtime	< 4:4.13.3-0ubuntu0.2	UNKNOWN
ubuntu	14.10	noarch	kde-runtime	< 4:4.14.1-0ubuntu1.1	UNKNOWN
ubuntu	12.04	noarch	webkitkde	< 1.1.0git80efcf77-1ubuntu1	UNKNOWN
ubuntu	14.04	noarch	webkitkde	< 1.3~git20120518.9a111005-3ubuntu1	UNKNOWN
ubuntu	14.10	noarch	webkitkde	< 1.3.4-1ubuntu0.1	UNKNOWN