CVE-2006-0019 Memory corruption in n/a

High 7.5 Published 20 Jan 2006 Updated 7 Aug 2024

Remote attackers can execute arbitrary code via crafted UTF-8 URIs exploiting a heap overflow in the KDE JavaScript interpreter.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2006-0019?

CVE-2006-0019 is a high-severity memory corruption vulnerability in Kde Kde, published on 20 Jan 2006. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Heap-based buffer overflow in the encodeURI and decodeURI functions in the kjs JavaScript interpreter engine in KDE 3.2.0 through 3.5.0 allows remote attackers to execute arbitrary code via a crafted, UTF-8 encoded URI.

Which versions are affected by CVE-2006-0019?

It affects 1 product.

Linux distribution packages (12)

`kdelibs` Red Hat:enterprise_linux:4::as	All versions	`6:3.3.1-3.14`
`kdelibs-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`6:3.3.1-3.14`
`kdelibs-devel` Red Hat:enterprise_linux:4::as	All versions	`6:3.3.1-3.14`
`kdelibs` Red Hat:enterprise_linux:4::desktop	All versions	`6:3.3.1-3.14`
`kdelibs-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`6:3.3.1-3.14`
`kdelibs-devel` Red Hat:enterprise_linux:4::desktop	All versions	`6:3.3.1-3.14`
`kdelibs` Red Hat:enterprise_linux:4::es	All versions	`6:3.3.1-3.14`
`kdelibs-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`6:3.3.1-3.14`
`kdelibs-devel` Red Hat:enterprise_linux:4::es	All versions	`6:3.3.1-3.14`
`kdelibs` Red Hat:enterprise_linux:4::ws	All versions	`6:3.3.1-3.14`
`kdelibs-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`6:3.3.1-3.14`
`kdelibs-devel` Red Hat:enterprise_linux:4::ws	All versions	`6:3.3.1-3.14`

Products include Kde Kde.

How do I fix CVE-2006-0019?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2006-0019 being exploited?

There is no known exploitation of CVE-2006-0019 in the wild and no public exploit code.

All Kde Kde vulnerabilities

Sources

Also known as DSA-948-1, GHSA-pmg9-q8pq-2g6h, RHSA-2006:0184.