CVE-2017-6410 – Ubuntu Security Notice USN-3223-1

https://notcve.org/view.php?id=CVE-2017-6410

02 Mar 2017 — kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file. kpac/script.cpp en KDE kio en versiones anteriores a 5.32 y kdelibs en versiones anteriores a 4.14.30 llama a la función PAC FindProxyForURL con una URL https completa (incluyendo potencialmente credenciales de ... • http://www.debian.org/security/2017/dsa-3849 • CWE-319: Cleartext Transmission of Sensitive Information •