Bug 514070 (CVE-2009-1724) - CVE-2009-1724 kdelibs: possible XSS vulnerability
Summary: CVE-2009-1724 kdelibs: possible XSS vulnerability
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2009-1724
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://web.nvd.nist.gov/view/vuln/det...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-07-27 20:17 UTC by Vincent Danen
Modified: 2021-11-12 19:58 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-08-06 15:11:54 UTC

Attachments (Terms of Use)

Description Vincent Danen 2009-07-27 20:17:13 UTC 
CVE-2009-1724 was originally given to a Safari Webkit issue:

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.

According to two Debian bug reports ([1], [2]) this may affect qt4 and webkit, which means it may also affect kdelibs.  I am unable to find any patches for qt4 or webkit as of yet.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538403 (qt4-x11)
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538402 (webkit)
Comment 5 Jan Lieskovsky 2009-08-06 14:32:09 UTC 
Official statement from Red Hat Security Response Team regarding this issue:
----------------------------------------------------------------------------

Not vulnerable. This issue did not affect the versions of the kdelibs
package, as shipped with Red Hat Enterprise Linux 3, 4, or 5.
Note You need to log in before you can comment on or make changes to this bug.