CVE-2012-4515 - Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when

CVE-2012-4515

Summary

Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by accessing an iframe when it is being updated.

References

Vulnerable Configurations

cpe:2.3:o:kde:kde:4.7.3:*:*:*:*:*:*:*
cpe:2.3:o:kde:kde:4.7.3:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 12-11-2012 - 21:15)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

bugtraq	20121030 Medium risk security flaws in Konqueror
confirm	http://quickgit.kde.org/index.php?p=kdelibs.git&a=commitdiff&h=4f2eb356f1c23444fff2cfe0a7ae10efe303d6d8
misc	http://www.nth-dimension.org.uk/pub/NDSA20121010.txt.asc
mlist	[oss-security] 20121011 Re: Pre-advisory for Konqueror 4.7.3 (other versions may be affected) [oss-security] 20121030 Medium risk security flaws in Konqueror
secunia	51097 51145

Last major update

12-11-2012 - 21:15

Published

11-11-2012 - 13:00

Last modified

12-11-2012 - 21:15