CVE-2007-1565 Denial of service in n/a

High 7.8 Published 21 Mar 2007 Updated 16 Sep 2024

Remote attackers can crash Konqueror by using JavaScript to access a child iframe with an FTP URI, requiring user interaction to visit a malicious page.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2007-1565?

CVE-2007-1565 is a high-severity denial of service vulnerability in n/a, published on 21 Mar 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Konqueror 3.5.5 allows remote attackers to cause a denial of service (crash) by using JavaScript to read a child iframe having an ftp:// URI.

Which versions are affected by CVE-2007-1565?

It affects 1 product.

Products include Kde Konqueror.

How do I fix CVE-2007-1565?

No fix has been published for CVE-2007-1565 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2007-1565 being exploited?

There is no known exploitation of CVE-2007-1565 in the wild and no public exploit code.

Sources

Also known as GHSA-p324-gcg2-ccr4.