Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI.

Maksim Orlovich discovered that the kjs JavaScript interpreter, used in the Konqueror web browser and in other parts of KDE, performs insufficient bounds checking when parsing UTF-8 encoded Uniform Resource Identifiers, which may lead to a heap based buffer overflow and the execution of arbitrary code.

Updated kdelibs packages are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

kdelibs contains libraries for the K Desktop Environment (KDE).

A heap overflow flaw was discovered affecting kjs, the JavaScript interpreter engine used by Konqueror and other parts of KDE. An attacker could create a malicious website containing carefully crafted JavaScript code that would trigger this flaw and possibly lead to arbitrary code execution. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0019 to this issue.

NOTE: this issue does not affect KDE in Red Hat Enterprise Linux 3 or 2.1.

Users of KDE should upgrade to these updated packages, which contain a backported patch from the KDE security team correcting this issue as well as two bug fixes.

New kdelibs packages are available for Slackware 10.0, 10.1, and 10.2 to fix a security issue with kjs.

The remote host is affected by the vulnerability described in GLSA-200601-11 (KDE kjs: URI heap overflow vulnerability)

    Maksim Orlovich discovered an incorrect bounds check in kjs when     handling URIs.
  Impact :

    By enticing a user to load a specially crafted webpage containing     malicious JavaScript, an attacker could execute arbitrary code with the     rights of the user running kjs.
  Workaround :

    There is no known workaround at this time.

A heap overflow vulnerability was discovered in kjs, the KDE JavaScript interpretter engine. An attacker could create a malicious web site that contained carefully crafted JavaScript code that could trigger the flaw and potentially lead to the arbitrary execution of code as the user visiting the site.

The updated packages have been patched to correct this problem.

Maksim Orlovich discovered that kjs, the JavaScript interpreter engine used by Konqueror and other parts of KDE, did not sufficiently verify the validity of UTF-8 encoded URIs. Specially crafted URIs could trigger a buffer overflow. By tricking an user into visiting a website with malicious JavaScript code, a remote attacker could exploit this to execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is missing the patch for the advisory SUSE-SA:2006:003 (kdelibs3).


Maksim Orlovich discovered a bug in the JavaScript interpreter used by Konqueror. UTF-8 encoded URLs could lead to a buffer overflow that causes the browser to crash or execute arbitrary code.
Attackers could trick users into visiting specially crafted web sites that exploit this bug (CVE-2006-0019).

A heap overflow flaw was discovered affecting kjs, the JavaScript interpreter engine used by Konqueror and other parts of KDE. An attacker could create a malicious website containing carefully crafted JavaScript code that would trigger this flaw and possibly lead to arbitrary code execution. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0019 to this issue. 

Users of KDE should upgrade to these updated packages, which contain a backported patch from the KDE security team correcting this issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
22814	Debian DSA-948-1 : kdelibs - buffer overflow	Nessus	Debian Local Security Checks	high
21981	CentOS 4 : kdelibs (CESA-2006:0184)	Nessus	CentOS Local Security Checks	high
20916	Slackware 10.0 / 10.1 / 10.2 : kdelibs (SSA:2006-045-05)	Nessus	Slackware Local Security Checks	high
20798	GLSA-200601-11 : KDE kjs: URI heap overflow vulnerability	Nessus	Gentoo Local Security Checks	high
20797	Mandrake Linux Security Advisory : kdelibs (MDKSA-2006:019)	Nessus	Mandriva Local Security Checks	high
20792	Ubuntu 5.04 / 5.10 : kdelibs vulnerability (USN-245-1)	Nessus	Ubuntu Local Security Checks	high
20758	SUSE-SA:2006:003: kdelibs3	Nessus	SuSE Local Security Checks	high
20756	Fedora Core 4 : kdelibs-3.5.0-0.4.fc4 (2006-050)	Nessus	Fedora Local Security Checks	high
20753	RHEL 4 : kdelibs (RHSA-2006:0184)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2006-0019

high

Tenable Plugins

high

high

high

high

high

high

high

high

high