The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0909 advisory.

    [3.5.4-13.el5.0.1]
     - Remove Version branding
     - Maximum rpm trademark logos removed (pics/crystalsvg/*-mime-rpm*)

     [3.5.4-13.el5]
     - Resolves: #293571        CVE-2007-0537 Konqueror improper HTML comment rendering        CVE-2007-1564 FTP protocol PASV design flaw affects konqueror

     [3.5.4-12.el5]
     - resolves: #293421, CVE-2007-3820 CVE-2007-4224 CVE-2007-4225
     - Resolves: #293911, UTF-8 overlong sequence decoding vulnerability,      CVE-2007-0242
     - Resolves: #293571, Konqueror improper HTML comment rendering,      CVE-2007-0537

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE).

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

Users of KDE should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2007:0909 advisory.

    The kdelibs package provides libraries for the K Desktop Environment (KDE).

    Two cross-site-scripting flaws were found in the way Konqueror processes     certain HTML content. This could result in a malicious attacker presenting     misleading content to an unsuspecting user. (CVE-2007-0242, CVE-2007-0537)

    A flaw was found in KDE JavaScript implementation.  A web page containing     malicious JavaScript code could cause Konqueror to crash. (CVE-2007-1308)

    A flaw was found in the way Konqueror handled certain FTP PASV commands.
    A malicious FTP server could use this flaw to perform a rudimentary     port-scan of machines behind a user's firewall. (CVE-2007-1564)

    Two Konqueror address spoofing flaws have been discovered. It was     possible for a malicious website to cause the Konqueror address bar to     display information which could trick a user into believing they are at a     different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

    Users of KDE should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that Konqueror did not correctly handle iframes from JavaScript. If a user were tricked into visiting a malicious website, Konqueror could crash, resulting in a denial of service.
(CVE-2007-1308)

A flaw was discovered in how Konqueror handled PASV FTP responses. If a user were tricked into visiting a malicious FTP server, a remote attacker could perform a port-scan of machines within the user's network, leading to private information disclosure. (CVE-2007-1564).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Konqueror が特定の HTML コンテンツを処理する方法で 2 つのクロスサイトスクリプティングの欠陥が見つかりました。この結果、悪意ある攻撃者が疑いを持たないユーザーに誤解を招くコンテンツを提示する可能性があります。
（CVE-2007-0242、CVE-2007-0537）

KDE JavaScript の実装に欠陥が見つかりました。悪意ある JavaScript コードが含まれる Web ページにより、Konqueror がクラッシュする可能性があります。
（CVE-2007-1308）

Konqueror が特定の FTP PASV コマンドを処理する方法で、欠陥が見つかりました。悪意のある FTP サーバーがこの欠陥を利用して、ユーザーのファイアウォールの背後にあるマシンの rudimentary ポートスキャンを実行する可能性があります。
（CVE-2007-1564）

2 つの Konqueror アドレスなりすましの欠陥が見つかりました。悪意ある Web サイトが Konqueror アドレスバーに表示する情報によりユーザーが騙され、実際の Web サイトとは異なる Webサイトにアクセスしていると錯覚させられる可能性がありました。（CVE-2007-3820、CVE-2007-4224）

リモートの Oracle Linux 5 ホストに、ELSA-2007-0909 のアドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    [3.5.4-13.el5.0.1]
     - バージョンブランディングの削除
     - 最大 rpm の商標ロゴが削除されましたpics/crystalsvg/*-mime-rpm*

     [3.5.4-13.el5]
     - 解決 #293571 CVE-2007-0537 Konqueror の不適切な HTML コメントレンダリング CVE-2007-1564 FTP プロトコル PASV デザインの欠陥が konqueror に影響

     [3.5.4-12.el5]
     - 解決 #293421、 CVE-2007-3820 CVE-2007-4224 CVE-2007-4225
     - 解決 #293911、UTF-8 の過剰に長いシーケンスデコードの脆弱性、 CVE-2007-0242
     - 解決 #293571、Konqueror の不適切な HTML コメントレンダリング、 CVE-2007-0537

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

在 Konqueror 处理特定 HTML 内容的方式中发现两个跨站脚本缺陷。这可导致恶意攻击者向毫无防范的用户提供误导性内容。
（CVE-2007-0242、CVE-2007-0537）

在 KDE JavaScript 实现中发现一个缺陷。包含恶意 JavaScript 代码的网页可导致 Konqueror 崩溃。
(CVE-2007-1308)

在 Konqueror 处理某些 FTP PASV 命令的方式中发现一个缺陷。恶意 FTP 服务器可利用此缺陷对用户防火墙后面的计算机执行基本端口扫描。
(CVE-2007-1564)

已发现两个 Konqueror 地址欺骗缺陷。恶意网站可以导致 Konqueror 地址栏显示信息，诱骗用户相信他们在访问需要的网站，但实际上不是。（CVE-2007-3820、CVE-2007-4224）

远程 Oracle Linux 5 主机上安装的程序包受到 ELSA-2007-0909 公告中提及的多个漏洞的影响。

    [3.5.4-13.el5.0.1]
     - 删除版本品牌
     - 删除了最大 rpm 商标徽标 (pics/crystalsvg/*-mime-rpm*)

     [3.5.4-13.el5]
     - 解决了 #293571 CVE-2007-0537 Konqueror 未正确渲染 HTML 注释 CVE-2007-1564 FTP 协议 PASV 设计缺陷影响 konqueror

     [3.5.4-12.el5]
     - 解决了 #293421、 CVE-2007-3820 CVE-2007-4224 CVE-2007-4225
     - 解决 #293911UTF-8 超长序列解码漏洞 CVE-2007-0242
     - 解决 #293571、Konqueror 不正确的 HTML 注释渲染 CVE-2007-0537

Tenable 已直接从 Oracle Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Oracle Linux 5 主機中安裝的套件受到 ELSA-2007-0909 公告中提及的多個弱點影響。

    [3.5.4-13.el5.0.1]
     - 移除版本商標
     - 移除 rpm 商標標誌的最大值 (pics/ crystalsvg/*-mime-rpm*)

     [3.5.4-13.el5]
     - 解決 #293571 CVE-2007-0537 Konqueror 不當轉譯 HTML 註解 CVE-2007-1564 FTP 通訊協定 PASV 設計瑕疵影響 konqueror

     [3.5.4-12.el5]
     - 解決 #293421、 CVE-2007-3820 CVE-2007-4224 CVE-2007-4225
     - 解決 #293911UTF-8 過長序列解碼弱點 CVE-2007-0242
     - 解決 #293571Konqueror 不當的 HTML 註解轉譯 CVE-2007-0537

Tenable 已直接從 Oracle Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ecma/kjs_html.cpp in KDE JavaScript (KJS), as used in Konqueror, allows remote attackers to cause a denial of service (crash) by accessing the content of an iframe with an ftp:// URI in the src attribute, probably due to a NULL pointer dereference.

Updated packages have been patched to address this issue.

Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user.
(CVE-2007-0242, CVE-2007-0537)

A flaw was found in KDE JavaScript implementation. A web page containing malicious JavaScript code could cause Konqueror to crash.
(CVE-2007-1308)

A flaw was found in the way Konqueror handled certain FTP PASV commands. A malicious FTP server could use this flaw to perform a rudimentary port-scan of machines behind a user's firewall.
(CVE-2007-1564)

Two Konqueror address spoofing flaws have been discovered. It was possible for a malicious website to cause the Konqueror address bar to display information which could trick a user into believing they are at a different website than they actually are. (CVE-2007-3820, CVE-2007-4224)

在 Konqueror 處理某些 HTML 內容的方式中發現兩個跨網站指令碼瑕疵。這可導致惡意攻擊者顯示誤導內容給不知情的使用者。
(CVE-2007-0242、CVE-2007-0537)

在 KDE JavaScript 實作中發現一個瑕疵。包含惡意 JavaScript 程式碼的網頁可導致 Konqueror 損毀。
(CVE-2007-1308)

在 Konqueror 處理某些 FTP PASV 命令的方式中發現一個瑕疵。惡意 FTP 伺服器可利用此瑕疵對使用者防火牆背後的機器執行初步連接埠掃描。
(CVE-2007-1564)

發現兩個 Konqueror 位址偽造瑕疵。惡意網站可以導致 Konqueror 位址列顯示可誘騙使用者相信他們位於和他們實際所在網站不同之網站的資訊。(CVE-2007-3820、CVE-2007-4224)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
67574	Oracle Linux 5 : Moderate: / kdelibs (ELSA-2007-0909)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
26974	CentOS 4 / 5 : kdelibs (CESA-2007:0909)	Nessus	CentOS Local Security Checks	2007/10/12	2021/1/4	medium
26952	RHEL 4 / 5 : kdelibs (RHSA-2007:0909)	Nessus	Red Hat Local Security Checks	2007/10/9	2024/11/4	medium
28044	Ubuntu 5.10 / 6.06 LTS / 6.10 : kdelibs vulnerabilities (USN-447-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
60263	Scientific Linux セキュリティ更新：SL5.x、SL4.x i386/x86_64 の kdelibs	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67574	ELSA-2007-0909Oracle Linux 5Moderate/kdelibs	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
60263	Scientific Linux 安全更新：SL5.x、SL4.x i386/x86_64 中的 kdelibs	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
67574	Oracle Linux 5Moderate: / kdelibs (ELSA-2007-0909)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
67574	Oracle Linux 5中等 / kdelibs (ELSA-2007-0909)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
24804	Mandrake Linux Security Advisory : kdelibs (MDKSA-2007:054)	Nessus	Mandriva Local Security Checks	2007/3/12	2021/1/6	high
60263	Scientific Linux Security Update : kdelibs on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
60263	Scientific Linux 安全性更新：SL5.x、SL4.x i386/x86_64 上的 kdelibs	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

medium

medium

high

medium

medium