The nodeType function in KDE libkhtml 4.2.0 and earlier as used by Konquerer KMail and other programs allows remote attackers to cause a denial of service (crash) via malformed HTML tags possibly involving a COL SPAN tag embedded in a RANGE tag.