CVE-2017-6410

Name	CVE-2017-6410
Description	kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-952-1, DSA-3849-1
NVD severity	medium
Debian Bugs	856889, 856890

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
kde4libs (PTS)	stretch	4:4.14.26-2	fixed
	buster	4:4.14.38-3	fixed
kio (PTS)	stretch	5.28.0-2	fixed
	buster	5.54.1-1	fixed
	bullseye, sid	5.78.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
kde4libs	source	wheezy	4:4.8.4-4+deb7u3	DLA-952-1
kde4libs	source	jessie	4:4.14.2-5+deb8u2	DSA-3849-1
kde4libs	source	(unstable)	4:4.14.26-2		856890
kio	source	(unstable)	5.28.0-2		856889

Notes

https://www.kde.org/info/security/advisory-20170228-1.txt
Patch for kio: https://commits.kde.org/kio/f9d0cb47cf94e209f6171ac0e8d774e68156a6e4
Patch for kde4libs: https://commits.kde.org/kdelibs/1804c2fde7bf4e432c6cf5bb8cce5701c7010559