Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via a crafted URI using the (1) zip, (2) trash, (3) tar, (4) thumbnail, (5) smtps, (6) smtp, (7) smb, (8) remote, (9) recentdocuments, (10) nntps, (11) nntp, (12) network, (13) mbox, (14) ldaps, (15) ldap, (16) fonts, (17) file, (18) desktop, (19) cgi, (20) bookmarks, or (21) ar scheme, which is not properly handled in an error message.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade kde-runtimeUpgrade kwebkitpart | Dec 10, 2025 | Nov 20, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 13, 2014 |
| Suse | — | Upgrade libkioarchive5Upgrade kio-extras5-langUpgrade kio-extras5 | Dec 18, 2015 | Dec 8, 2014 |
| Ubuntu | — | Upgrade kde-runtime | Nov 8, 2024 | Dec 8, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub