CVE-2011-1168: XSS
Cross-site scripting (XSS) vulnerability in the KHTMLPart::htmlError function in khtml/khtmlpart.cpp in Konqueror in KDE SC 4.4.0 through 4.6.1 allows remote attackers to inject arbitrary web script or HTML via the URI in a URL corresponding to an unavailable web site.
Other sources
It was reported [1] that Konqueror in KDE 4.4.0 through to and including 4.6.1 is vulnerable to a partially universal XSS in error pages. When Konqueror cannot fetch a requested URL, it renders an error page that contains the given URL. If the URL were to contain JavaScript or HTML code, the code is also rendered which could allow for a user to be tricked into visiting a malicious web site or to provide credentials to an untrusted party.
Patches are available for the 4.4, 4.5, and 4.6 branches, linked to from the upstream security advisory.
[1] http://www.kde.org/info/security/advisory-20110411-1.txt
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1168?
CVE-2011-1168 is considered a critical cross-site scripting (XSS) vulnerability that allows for arbitrary web script injection.
How do I fix CVE-2011-1168?
To fix CVE-2011-1168, users should upgrade to the latest version of KDE SC that addresses this vulnerability.
Which versions of KDE SC are affected by CVE-2011-1168?
KDE SC versions 4.4.0 to 4.6.1, including various beta and release candidates, are affected by CVE-2011-1168.
How does the CVE-2011-1168 vulnerability work?
CVE-2011-1168 allows attackers to inject arbitrary web scripts or HTML through manipulated URIs for unavailable websites.
Who can exploit CVE-2011-1168?
Remote attackers can exploit CVE-2011-1168 to execute scripts in the context of the victim's web browser.