CVE-2017-6410

Name of the Vulnerable Software and Affected Versions KDE kio versions prior to 5.32 kdelibs versions prior to 4.14.30

Description The issue allows remote attackers to obtain sensitive information via a crafted PAC file. This is due to the kpac/script.cpp in KDE kio and kdelibs calling the PAC FindProxyForURL function with a full https URL, potentially including Basic Authentication credentials, a query string, or PATH INFO.

Recommendations For KDE kio versions prior to 5.32, update to version 5.32 or later. For kdelibs versions prior to 4.14.30, update to version 4.14.30 or later.