CVE-2004-0411
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters...
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
Exploit likelihood
What each source reports
NVD Score used
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
- Record
CVE-2004-0411- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-88
- Updated
- 2026-11-02
CVE List No score
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
- Record
CVE-2004-0411- Updated
- 2026-11-02
EUVDEUVD-2004-0411 No score
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
- Record
EUVD-2004-0411- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rgp9-mx7h-rwqv No score
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters...
The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are passed to the associated programs, possibly to read arbitrary files or execute arbitrary code.
- Record
GHSA-rgp9-mx7h-rwqv- Weakness
- CWE-20, CWE-88
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kdelibsDebian:3.0 |
before 4:2.2.2-13.woody.10 | 4:2.2.2-13.woody.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0411 is a high vulnerability (CVSS 7.5) in Kde Konqueror, published May 20, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.78%, the 94th percentile. Fixed in kdelibs 4:2.2.2-13.woody.10.
References
redhat.com/support/errata/RHSA-2004-222.html
novell.com/linux/security/advisories/2004_14_kdelibs.html
kde.org/info/security/advisory-20040517-1.txt
exchange.xforce.ibmcloud.com/vulnerabilities/16163
securityfocus.com/advisories/6717
Show 14 moreShow less
debian.org/security/2004/dsa-518
osvdb.org/6107
marc.info?l=bugtraq&m=108481412427344&w=2
secunia.com/advisories/11602
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000843
slackware.org/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.362635
security.gentoo.org/glsa/glsa-200405-11.xml
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A954
ciac.org/ciac/bulletins/o-146.shtml
nvd.nist.gov/vuln/detail/CVE-2004-0411
github.com/advisories/GHSA-rgp9-mx7h-rwqv