CVE-2017-6410 kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string,....
MediumCVSS 5.5
EPSS 0.86%
- Published
- Updated
- Exploit status
- No public exploit known
Description
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kio(Debian:12) | < 5.28.0-2 | 5.28.0-2 |
| debian/kio(Debian:13) | < 5.28.0-2 | 5.28.0-2 |
| debian/kio(Debian:14) | < 5.28.0-2 | 5.28.0-2 |
| kdelibs | <= 4.14.29 | No fix listed |
| KDE kio | <= 5.31 | No fix listed |
References
- Debian Security Tracker CVE-2017-6410 vendor-advisory
- DSA-3849 vendor-advisory
- 96515 vdb-entry
- www.kde.org patch vendor-advisory
- bugs.debian.org issue-tracking