| Package | Affected versions | Patched versions |
|---|---|---|
| konqueror | = 2.1.1= 2.2.2= 3.0= 3.0.1= 3.0.2= 3.0.3= 3.0.5= 3.1= 3.1.1= 3.1.2 | |
| konqueror embedded | = 0.1 | |
| analog real-time synthesizer | = 2.1.1-5= 2.2-11 | |
| kdebase | = 3.0.3-13 | |
| kdelibs | = 2.1.1-5= 2.2-11= 3.0.0-10= 3.1-10 | |
| kdelibs devel | = 2.1.1-5= 2.2-11= 3.0.0-10= 3.0.3-8= 3.1-10 | |
| kdelibs sound | = 2.1.1-5= 2.2-11 | |
| kdelibs sound devel | = 2.1.1-5= 2.2-11 |
KDE Konqueror for KDE 3.1.2 and earlier does not remove authentication credentials from URLs of the "user:password@host" form in the HTTP-Referer header, which could allow remote web sites to steal the credentials for pages that link to the sites.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free