High severity · published Jun 13, 2017
CVE-2017-9604
KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the…
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
KDE kmail before 5.5.2 and messagelib before 5.5.2, as distributed in KDE Applications before 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KM
Kmail · Kde
through 5.5.1 · source: NVD
ME
Messagelib · Kde
through 5.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-9604
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-9604
Mailing List
https://commits.kde.org/kmail/78c5552be2f00a4ac25bd77ca39386522fca70a8
Mailing List
https://commits.kde.org/messagelib/c54706e990bbd6498e7b1597ec7900bc809e8197
More from Kmail
8.1
CVE-2016-7967
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled
7.3
CVE-2016-7966
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer
6.5
CVE-2020-15954
KDE KMail 19.12.3 (aka 5.13.3) engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use
6.5
CVE-2020-11880
An issue was discovered in KDE KMail before 19.12.3
6.5
CVE-2016-7968
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled