CVE-2017-6410 Information disclosure in n/a

What is CVE-2017-6410?

CVE-2017-6410 is a medium-severity vulnerability in n/a, published on 2 Mar 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

Weakness: CWE-319

Which versions are affected by CVE-2017-6410?

It affects 2 products.

Products include Kde Kdelibs, Kde Kio.

How do I fix CVE-2017-6410?

Upgrade to a fixed version.

Is CVE-2017-6410 being exploited?

There is no known exploitation of CVE-2017-6410 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2009-2702 Security feature bypass in n/a High 7.5
• CVE-2004-1165 Command injection in n/a High 7.5
• CVE-2013-2074 Information disclosure in n/a Medium 5.0
• CVE-2014-3494 Information disclosure in n/a Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2017-6410, GHSA-6qcm-9vg4-jxv8, MGASA-2017-0079, UBUNTU-CVE-2017-6410, USN-3223-1, openSUSE-SU-2017:0677-1 and 1 more.