PT-2017-19064 · Kde · Messagelib+2

Published 2017-06-13 · Updated 2019-10-03 · CVE-2017-9604

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions KDE kmail versions prior to 5.5.2 messagelib versions prior to 5.5.2 KDE Applications versions prior to 17.04.2

Description The issue allows remote attackers to obtain sensitive information by sniffing the network, due to the lack of ensuring a plugin's sign/encrypt action during the use of the Send Later feature.

Recommendations For KDE kmail versions prior to 5.5.2, update to version 5.5.2 or later to resolve the issue. For messagelib versions prior to 5.5.2, update to version 5.5.2 or later to resolve the issue. For KDE Applications versions prior to 17.04.2, update to version 17.04.2 or later to resolve the issue.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2017-9604

OPENSUSE-SU-2017:1748-1

OPENSUSE-SU-2017:1756-1

Affected Products

Kde Applications

Kde Kmail

Messagelib

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-9604 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-9604 · Vendor Advisory
• https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8 · Patch
• https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2017:1756-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-9604 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9604 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-9604 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-9604 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2017:1748-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9604 · Security Note
• https://bugzilla.suse.com/1044210 · Note
• https://suse.com/security/cve/CVE-2017-9604 · Note