CVE-2004-0689

HighCVSS 7.1/10Last modified Jun 16, 2026

Description

KDE before 3.3.0 does not properly handle when certain symbolic links point to "stale" locations, which could allow local users to create or truncate arbitrary files.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864Broken Link
http://marc.info/?l=bugtraq&m=109225538901170&w=2Mailing List
http://secunia.com/advisories/12276/Broken Link, Patch, Vendor Advisory
http://security.gentoo.org/glsa/glsa-200408-13.xmlThird Party Advisory
http://www.debian.org/security/2004/dsa-539Third Party Advisory
http://www.kde.org/info/security/advisory-20040811-1.txtPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16963Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9334Broken Link
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000864Broken Link
http://marc.info/?l=bugtraq&m=109225538901170&w=2Mailing List
http://secunia.com/advisories/12276/Broken Link, Patch, Vendor Advisory
http://security.gentoo.org/glsa/glsa-200408-13.xmlThird Party Advisory
http://www.debian.org/security/2004/dsa-539Third Party Advisory
http://www.kde.org/info/security/advisory-20040811-1.txtPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16963Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9334Broken Link

Timeline

Published: Sep 28, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-06904.6The DCOPServer in KDE 3.2.3 and earlier allows local users to gain unauthorized access via a symlink attack on DCOP files in the /tmp direct CVE-2004-06917.5Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of CVE-2004-06925.0The XPM parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed CVE-2004-06935.0The GIF parser in the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) via a malformed CVE-2004-06946.8Buffer overflow in LHA 1.14 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CVE-2004-06957.5Stack-based buffer overflow in the FTP service for 4D WebSTAR 5.3.2 and earlier allows remote attackers to execute arbitrary code via a long CVE-2004-06965.0The ShellExample.cgi script in 4D WebSTAR 5.3.2 and earlier allows remote attackers to list arbitrary directories via a URL with the desired CVE-2004-06975.0Unknown vulnerability in 4D WebSTAR 5.3.2 and earlier allows remote attackers to read the php.ini configuration file and possibly obtain sen CVE-2004-06983.64D WebSTAR 5.3.2 and earlier allows local users to read and modify arbitrary files via a symlink attack.CVE-2004-06997.5Heap-based buffer overflow in ASN.1 decoding library in Check Point VPN-1 products, when Aggressive Mode IKE is implemented, allows remote a CVE-2004-07007.5Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 m CVE-2004-07014.6Sun Ray Server Software (SRSS) 1.3 and 2.0 for Solaris 2.6, 7 and 8 does not properly detect a smartcard removal when the card is quickly re