CVE-2017-6410: Medium severity KDE kdelibs vulnerability
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATHINFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6410?
CVE-2017-6410 is rated as important due to the potential exposure of sensitive information.
How do I fix CVE-2017-6410?
To fix CVE-2017-6410, upgrade KDE kio to version 5.32 or higher, and KDE kdelibs to version 4.14.30 or higher.
What vulnerabilities does CVE-2017-6410 exploit?
CVE-2017-6410 exploits a weakness in the handling of PAC files that could lead to sensitive data exposure.
Which software is affected by CVE-2017-6410?
CVE-2017-6410 affects KDE kdelibs versions prior to 4.14.30 and KDE kio versions prior to 5.32.
Can CVE-2017-6410 affect authentication credentials?
Yes, CVE-2017-6410 can potentially expose Basic Authentication credentials if included in the URL.