CVE-2017-9604 KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, wh...
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kf5-messagelib(Debian:12) | < 4:16.04.3-3 | 4:16.04.3-3 |
| KDE kmail | <= 5.5.1 | No fix listed |
| KDE messagelib | <= 5.5.1 | No fix listed |
References
- Debian Security Tracker CVE-2017-9604 vendor-advisory
- commits.kde.org mailing-list patch tool-signature
- commits.kde.org mailing-list patch tool-signature
- bugs.debian.org issue-tracking