Joined: 25 Feb 2003
Location: Essen, Germany
|Posted: Tue Jan 11, 2005 1:42 pm Post subject: [ GLSA 200501-16 ] Konqueror: Java sandbox vulnerabilities
|Gentoo Linux Security Advisory
Title: Konqueror: Java sandbox vulnerabilities (GLSA 200501-16)
Date: January 11, 2005
Updated: January 12, 2005
The Java sandbox environment in Konqueror can be bypassed to access arbitrary packages, allowing untrusted Java applets to perform unrestricted actions on the host system.
KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. Konqueror is the KDE web browser and file manager.
Vulnerable: < 3.3.2
Unaffected: >= 3.3.2
Architectures: All supported architectures
A remote attacker could embed a malicious Java applet in a web page and entice a victim to view it. This applet can then bypass security restrictions and execute any command, or access any file with the rights of the user running Konqueror.
There is no known workaround at this time.
All kdelibs users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose kde-base/kdelibs
KDE Security Advisory: Konqueror Java Vulnerability
Last edited by GLSA on Sun May 07, 2006 4:54 pm; edited 1 time in total