CVE-2017-6410

Publication date 2 March 2017

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
kde4libs	16.10 yakkety	Fixed 4:4.14.22-0ubuntu2.1
	16.04 LTS xenial	Fixed 4:4.14.16-0ubuntu3.1
	14.04 LTS trusty	Fixed 4:4.13.3-0ubuntu0.4
	12.04 LTS precise	Fixed 4:4.8.5-0ubuntu0.6
kio	16.10 yakkety	Fixed 5.26.0-0ubuntu2.1
	16.04 LTS xenial	Fixed 5.18.0-0ubuntu1.1
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not in release

Severity score breakdown

Parameter	Value
Base score	5.5 · Medium
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

USN-3223-1
KDE-Libs vulnerability
9 March 2017