Description
kpac/script.cpp in KDE kio before 5.32 and kdelibs before 4.14.30 calls the PAC FindProxyForURL function with a full https URL (potentially including Basic Authentication credentials, a query string, or PATH_INFO), which allows remote attackers to obtain sensitive information via a crafted PAC file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kio | 5.28.0-2 | — |
| Debian 13 | kio | 5.28.0-2 | — |
| Debian 12 | kio | 5.28.0-2 | — |
| Debian 8 | kde4libs | 4:4.14.2-5+deb8u2 | DSA-3849-1 |
| Debian 7 | kde4libs | 4:4.8.4-4+deb7u3 | DLA-952-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | kde4libs | 4:4.14.16-0ubuntu3.1 | — |
| Ubuntu 16.04 LTS | kio | 5.18.0-0ubuntu1.1 | — |
| Ubuntu 14.04 LTS | kde4libs | 4:4.13.3-0ubuntu0.4 | USN-3223-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 SP2 | kdelibs4 +1 | 4.14.25-5.3 | openSUSE-SU-2017:0680-1, openSUSE-SU-2017:0677-1 |
| SUSE Package Hub 12 SP2 | kio | 5.26.0-5.1 | openSUSE-SU-2017:0680-1, openSUSE-SU-2017:0677-1 |
| SUSE Package Hub 12 SP1 | kdelibs4 +1 | 4.14.25-5.3 | openSUSE-SU-2017:0680-1, openSUSE-SU-2017:0677-1 |
| SUSE Package Hub 12 SP1 | kio | 5.26.0-5.1 | openSUSE-SU-2017:0680-1, openSUSE-SU-2017:0677-1 |
Advisories 5
- USN-3223-1 kde4libs vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-952-1 kde4libs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3849-1 kde4libs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2017:0680-1 Security update for kdelibs4, kio SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2017:0677-1 Security update for kdelibs4, kio SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-3849 vendor-advisory
- 96515 vdb-entry
- https://www.kde.org/info/security/advisory-20170228-1.txt