{"id":"CVE-2002-1393","aliases":["DEBIAN-CVE-2002-1393","DSA-234","DSA-235","DSA-236","DSA-237","DSA-238","DSA-239","DSA-240","DSA-241","DSA-242","DSA-243","EUVD-2002-1377","GHSA-2f68-gh55-5wgh"],"status":"published","title":"Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that...","description":"Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03671,"percentile":0.89726,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2003-01-08T05:00:00Z","modified":"2026-06-16T21:59:14Z","fixes":[{"ecosystem":"Debian:3.0","package":"kdeadmin","fixed_in":["2.2.2-7.2"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdegraphics","fixed_in":["2.2.2-6.10"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdelibs","fixed_in":["2.2.2-13.woody.6"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdenetwork","fixed_in":["2.2.2-14.6"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdepim","fixed_in":["2.2.2-5.2"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdesdk","fixed_in":["2.2.2-3.2"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdegames","fixed_in":["2.2.2-2.2"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdeutils","fixed_in":["2.2.2-9.2"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdebase","fixed_in":["2.2.2-14.2"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"kdemultimedia","fixed_in":["2.2.2-8.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:3.0","package":"kdeadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-7.2"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdegraphics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-6.10"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdelibs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-13.woody.6"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdenetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-14.6"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdepim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5.2"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdesdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3.2"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdegames","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-2.2"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdeutils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-9.2"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdebase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-14.2"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"kdemultimedia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-8.2"}]}]}],"products":[{"vendor":"kde","product":"kde"}],"references":[{"url":"http://www.debian.org/security/2003/dsa-243","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.debian.org/security/2003/dsa-236","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.debian.org/security/2003/dsa-234","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.debian.org/security/2003/dsa-242","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.debian.org/security/2003/dsa-235","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.debian.org/security/2003/dsa-241","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://secunia.com/advisories/8103","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://secunia.com/advisories/8067","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.debian.org/security/2003/dsa-239","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2003-002.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.debian.org/security/2003/dsa-240","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.redhat.com/support/errata/RHSA-2003-003.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104049734911544\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.securityfocus.com/bid/6462","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000569","tags":["vendor-advisory","x_refsource_CONECTIVA","x_transferred"]},{"url":"http://www.debian.org/security/2003/dsa-238","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2003:004","tags":["vendor-advisory","x_refsource_MANDRAKE","x_transferred"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104066520330397\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.kde.org/info/security/advisory-20021220-1.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.debian.org/security/2003/dsa-237","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-1393"},{"url":"https://github.com/advisories/GHSA-2f68-gh55-5wgh"}],"sources":{"cve":[{"id":"CVE-2002-1393","description":"Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.","status":"published","published":"2003-01-08T05:00:00Z","modified":"2024-08-08T03:19:28.609Z","updated_at":"2026-11-02T14:33:54.641433Z"}],"euvd":[{"id":"EUVD-2002-1377","description":"Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.","status":"published","published":"2003-01-08T05:00:00Z","modified":"2024-08-08T03:19:28Z","updated_at":"2026-11-03T01:14:56.257509Z"}],"ghsa":[{"id":"GHSA-2f68-gh55-5wgh","title":"Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that...","description":"Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.","status":"published","published":"2022-04-30T18:21:04Z","modified":"2023-01-30T05:06:09Z","updated_at":"2026-11-02T14:47:26.333114Z"}],"nvd":[{"id":"CVE-2002-1393","description":"Multiple vulnerabilities in KDE 2 and KDE 3.x through 3.0.5 do not quote certain parameters that are inserted into a shell command, which could allow remote attackers to execute arbitrary commands via (1) URLs, (2) filenames, or (3) e-mail addresses.","status":"published","published":"2003-01-17T05:00:00Z","modified":"2026-06-16T21:59:14.647Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:00:43.787686Z"}],"osv":[{"id":"DSA-234","title":"kdeadmin - several vulnerabilities","status":"published","published":"2003-01-22T00:00:00Z","modified":"2026-03-09T01:20:13.646887Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-235","title":"kdegraphics - several vulnerabilities","status":"published","published":"2003-01-22T00:00:00Z","modified":"2026-03-09T01:18:33.914953Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-236","title":"kdelibs - several vulnerabilities","status":"published","published":"2003-01-22T00:00:00Z","modified":"2026-03-09T01:20:10.516507Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-237","title":"kdenetwork - several vulnerabilities","status":"published","published":"2003-01-22T00:00:00Z","modified":"2026-03-09T01:23:26.615837Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"DSA-238","title":"kdepim - several vulnerabilities","status":"published","published":"2003-01-23T00:00:00Z","modified":"2026-03-09T01:18:11.833919Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-239","title":"kdesdk - several vulnerabilities","status":"published","published":"2003-01-23T00:00:00Z","modified":"2026-03-09T01:20:21.578144Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-240","title":"kdegames - several vulnerabilities","status":"published","published":"2003-01-23T00:00:00Z","modified":"2026-03-09T01:19:02.989775Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-241","title":"kdeutils - several vulnerabilities","status":"published","published":"2003-01-24T00:00:00Z","modified":"2026-03-09T01:23:06.176562Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-242","title":"kdebase - several vulnerabilities","status":"published","published":"2003-01-24T00:00:00Z","modified":"2026-03-09T01:19:27.174998Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-243","title":"kdemultimedia - several vulnerabilities","status":"published","published":"2003-01-24T00:00:00Z","modified":"2026-03-09T01:19:20.59312Z","updated_at":"2026-11-02T15:46:15.489951Z"}]}}