Read the docs
TI-2004-00375 Aliases CVE-2004-0411GHSA-rgp9-mx7h-rwqv

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-"…

Priority MEDIUM 43CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-88.

Summary

The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.

Why it matters now

EPSS 0.07778 94th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kde:konqueror:*:*:*:*:*:*:*:*up to 3.2.2VulnerableKDE
  • cpe:2.3:a:kde:konqueror:*:*:*:*:*:*:*:* Versions up to 3.2.2 Vulnerable ·KDE

Remediation

Red Hat 1 advisory

  • RHSA-2004:222 Released 2004-05-17 · Red Hat rating Important
    kdelibs security update
    • Red Hat Enterprise Linux AS (Advanced Server) version 2.1
    • Red Hat Linux Advanced Workstation 2.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 Fixed RHSA-2004:222
Red Hat Linux Advanced Workstation 2.1Fixed RHSA-2004:222

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-0411
  2. 2026-10-03 Alias added: GHSA-rgp9-mx7h-rwqv

References

Patch 1

Advisory 8

Other 2

  • TI-2004-00791 Mozilla Firefox 0.9.2 allows web sites to set cookies for country-specific top-level… CVSS 2.0HIGH 7.5
  • TI-2004-00790 Internet Explorer 6.0 allows web sites to set cookies for country-specific top-level… CVSS 2.0HIGH 7.5
  • TI-2004-01059 Konqueror 3.3.1 allows remote attackers to execute arbitrary FTP commands via an ftp://… CVSS 2.0HIGH 7.5
  • TI-2003-00552 Konqueror in KDE 3.1.3 and earlier (kdelibs) allows remote attackers to bypass intended… CVSS 2.0HIGH 7.5
  • TI-2002-01119 The cross-site scripting protection for Konqueror in KDE 2.2.2 and 3.0 through 3.0.3 does… CVSS 2.0HIGH 7.5
  • TI-2004-01053 Konqueror 3.x up to 3.2.2-6, and possibly other versions, allows remote attackers to… CVSS 2.0HIGH 7.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences