Bug 248537 (CVE-2007-3820) - CVE-2007-3820 Spoofing of URI possible in Konqueror's address bar
Summary: CVE-2007-3820 Spoofing of URI possible in Konqueror's address bar
Alias: CVE-2007-3820
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL: http://www.securityfocus.com/archive/...
Depends On: 290851 290861 290871 290881 293401 293411 293421 293431
TreeView+ depends on / blocked
Reported: 2007-07-17 10:56 UTC by Lubomir Kundrak
Modified: 2021-11-12 19:42 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2007-09-05 14:59:50 UTC

Attachments (Terms of Use)
Upstream patch for CVE-2007-3820 Konqueror URI spoofing (765 bytes, patch)
2007-07-17 13:15 UTC, Lubomir Kundrak
no flags Details | Diff

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0905 0 normal SHIPPED_LIVE Moderate: kdebase security update 2008-01-08 17:50:28 UTC
Red Hat Product Errata RHSA-2007:0909 0 normal SHIPPED_LIVE Moderate: kdelibs security update 2008-01-09 01:17:18 UTC

Description Lubomir Kundrak 2007-07-17 10:56:33 UTC
Description of problem:

An URI that appears in the address bar is scrolled to the right,
and thus a long URI padded with whitespace can be used to trick

Version-Release number of selected component (if applicable):

        CVE-2007-3820 Probably Affects: RHEL2.1
        CVE-2007-3820 Probably Affects: RHEL3
        CVE-2007-3820 Affects: RHEL4
        CVE-2007-3820 Affects: RHEL5
        CVE-2007-3820 Affects: FC6
        CVE-2007-3820 Affects: FC7

Steps to Reproduce:
1. Visit http://alt.swiecki.net/oper1.html

tp://alt.swiecki.net/oper1.html with konqueror

Actual results:


Additional info:

An data: URI (with inline HTML) can contain real spaces, not just %20.

Comment 1 Lubomir Kundrak 2007-07-17 13:15:42 UTC
Created attachment 159428 [details]
Upstream patch for CVE-2007-3820 Konqueror URI spoofing

Comment 2 Tomas Hoger 2007-08-14 14:06:56 UTC
Upstream patch in #c1 creates new problem, which got CVE name CVE-2007-4225.

Comment 3 Tomas Hoger 2007-08-20 10:36:05 UTC
KDE security advisory targeting CVE-2007-3820, CVE-2007-4224 and CVE-2007-4225
with references to official upstream patches:


Comment 4 Than Ngo 2007-08-30 17:14:17 UTC
it's only affected in RHEL-4/RHEL5, but not in RHEL-2.1 and RHEL-3

Comment 6 Mark J. Cox 2007-09-05 14:59:50 UTC
this is a low severity flaw which does not trigger the need for a security
update to kde.  We will fix this issue when other issues of higher severity
trigger a kde security update.

Note You need to log in before you can comment on or make changes to this bug.