CVE-2017-6410

Upstream information

CVE-2017-6410 at MITRE

Description

kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.

SUSE information

Overall state of this security issue: Ignore

This issue is currently rated as having moderate severity.

CVSS v2 Scores
	National Vulnerability Database	SUSE
Base Score	4.3	5
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N	AV:N/AC:L/Au:N/C:P/I:N/A:N
Access Vector	Network	Network
Access Complexity	Medium	Low
Authentication	None	None
Confidentiality Impact	Partial	Partial
Integrity Impact	None	None
Availability Impact	None	None

CVSS v3 Scores
	National Vulnerability Database
Base Score	5.5
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Access Vector	Local
Access Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	None
Availability Impact	None
CVSSv3 Version	3

SUSE Bugzilla entries: 1027309 [RESOLVED / DUPLICATE], 1027520 [RESOLVED]

SUSE Security Advisories:

openSUSE-SU-2017:0677-1, published Mon, 13 Mar 2017 15:24:46 +0100 (CET)
openSUSE-SU-2017:0680-1, published Mon, 13 Mar 2017 15:25:41 +0100 (CET)

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub for SUSE Linux Enterprise 12 SP1	`kdelibs4 >= 4.14.18-6.2` `kdelibs4-apidocs >= 4.14.18-6.2` `kdelibs4-branding-upstream >= 4.14.18-6.2` `kdelibs4-core >= 4.14.18-6.2` `kdelibs4-core-debuginfo >= 4.14.18-6.2` `kdelibs4-debuginfo >= 4.14.18-6.2` `kdelibs4-debugsource >= 4.14.18-6.2` `kdelibs4-doc >= 4.14.18-6.2` `kdelibs4-doc-debuginfo >= 4.14.18-6.2` `kio >= 5.20.0-6.2` `kio-core >= 5.20.0-6.2` `kio-core-debuginfo >= 5.20.0-6.2` `kio-debuginfo >= 5.20.0-6.2` `kio-debugsource >= 5.20.0-6.2` `kio-devel >= 5.20.0-6.2` `kio-devel-debuginfo >= 5.20.0-6.2` `kio-lang >= 5.20.0-6.2` `libkde4 >= 4.14.18-6.2` `libkde4-debuginfo >= 4.14.18-6.2` `libkde4-devel >= 4.14.18-6.2` `libkdecore4 >= 4.14.18-6.2` `libkdecore4-debuginfo >= 4.14.18-6.2` `libkdecore4-devel >= 4.14.18-6.2` `libkdecore4-devel-debuginfo >= 4.14.18-6.2` `libksuseinstall-devel >= 4.14.18-6.2` `libksuseinstall1 >= 4.14.18-6.2` `libksuseinstall1-debuginfo >= 4.14.18-6.2`	Patchnames: openSUSE-2017-334
SUSE Package Hub for SUSE Linux Enterprise 12 SP2	`kdelibs4 >= 4.14.25-5.3` `kdelibs4-apidocs >= 4.14.25-5.3` `kdelibs4-branding-upstream >= 4.14.25-5.3` `kdelibs4-core >= 4.14.25-5.3` `kdelibs4-core-debuginfo >= 4.14.25-5.3` `kdelibs4-debuginfo >= 4.14.25-5.3` `kdelibs4-debugsource >= 4.14.25-5.3` `kdelibs4-doc >= 4.14.25-5.3` `kdelibs4-doc-debuginfo >= 4.14.25-5.3` `kio >= 5.26.0-5.1` `kio-core >= 5.26.0-5.1` `kio-core-debuginfo >= 5.26.0-5.1` `kio-debuginfo >= 5.26.0-5.1` `kio-debugsource >= 5.26.0-5.1` `kio-devel >= 5.26.0-5.1` `kio-devel-debuginfo >= 5.26.0-5.1` `kio-lang >= 5.26.0-5.1` `libkde4 >= 4.14.25-5.3` `libkde4-debuginfo >= 4.14.25-5.3` `libkde4-devel >= 4.14.25-5.3` `libkdecore4 >= 4.14.25-5.3` `libkdecore4-debuginfo >= 4.14.25-5.3` `libkdecore4-devel >= 4.14.25-5.3` `libkdecore4-devel-debuginfo >= 4.14.25-5.3` `libksuseinstall-devel >= 4.14.25-5.3` `libksuseinstall1 >= 4.14.25-5.3` `libksuseinstall1-debuginfo >= 4.14.25-5.3`	Patchnames: openSUSE-2017-334