CVE-2017-6410
Fixed in a distro release EPSS <1%
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | kio | 5.28.0-2 |
| Debian 13 | kio | 5.28.0-2 |
| Debian 14 | kio | 5.28.0-2 |
| Debian 7 | kde4libs | 4:4.8.4-4+deb7u3 |
| Debian 8 | kde4libs | 4:4.14.2-5+deb8u2 |
| SUSE Package Hub 12 SP1 | kdelibs4 | 4.14.25-5.3 |
| SUSE Package Hub 12 SP1 | kdelibs4-apidocs | 4.14.25-5.3 |
| SUSE Package Hub 12 SP1 | kio | 5.26.0-5.1 |
| SUSE Package Hub 12 SP2 | kdelibs4 | 4.14.25-5.3 |
| SUSE Package Hub 12 SP2 | kdelibs4-apidocs | 4.14.25-5.3 |
| SUSE Package Hub 12 SP2 | kio | 5.26.0-5.1 |
| Ubuntu 14.04 LTS | kde4libs | 4:4.13.3-0ubuntu0.4 |
| Ubuntu 16.04 LTS | kde4libs | 4:4.14.16-0ubuntu3.1 |
| Ubuntu 16.04 LTS | kio | 5.18.0-0ubuntu1.1 |